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From: 

Sent: 

To: 

Subject: 



t>GC) (FBI) 

I I W. (SE) (FBI) 

, Wednesday, January 04. 2QQQ 7:34 pm 

I , , K OGC) (FBI) 

RE: Response to EC dated 12/2-/2005 re databases 


SENSITIVE BUT UNCLASSIFIED 

NON-RECORD fcg 

b7C 

DCS300 0 is a pen register system that captures pertinent info from that side of the house. 

3 | criminal but I belief all ryrtinent info from the dark side is indexed ioiflJtaLsystem too. 

i ne info is also migrated inti hd some agents sometimes upload info inti I . 

1 1 fo2 

Thanks for tackling this! ib 7 E 


— Original 


To: 

Subject: 


databases 


SENSITIVE BUT UNCLASSIFIED 
NON-RE CORD 


Funny you should ask. Someone else just sent me an email asking about ACS and| | And I have to 

work on those. (I am not sure why we would want telephone databases since minimization doesn't apply but I know 
that the EC asks about al l databases with FISA material, and that would ostensibly include pen register info, so I have 
to check on that! I ] s a criminal system, for Title Ills, is it not? If so, we are not concerned with it. Do not worry 
about th j | That is run from headquarters and we can provide all the info on that. I don't know what DCS3000 

is. Can you orieriy explain it. Thanks. 

From: I ^ l (SE) (FBI) 

Sent: Ian, .an, /U W 7; i3 p M 

To: I l OGn (FBI) 

Subject: RE: Response to EC dated 12/2-/2005 re databases 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Sorry to ask one of what I'm sure is a flood of questions about this, but. . . 


The following databases are not listed in your message as one’s covered by the "HQ team", nor were they listed in 
Dillingham's ec, do you know if these databases are subject to this tasking?: , 


■ DCS3QQP 


Thanks, and sorry to pester you. 


b7C 

b2 

b7E 


— Original Mes sage — 

From: I 

Sent: Wednesday, January 04, 2 


JOGC) (FBI) 
006 3:49 PM 


To: FBI_ALL CDCs 


ALL INFORMATION COJJTAINED 
HEREIN IS UNCLASSIFIED 

DATE 06-13-2007 BY 65179 DHH/TAM/KSR/cb #1056287 » 


/V. 1 




.MICHAEL 


fOTDl fFBDl 

llOTDl CFBIl 

|OTD) (FBI)| 

_JOGC) (FBI) b 


Subject: Response to EC dated 12/2-/2005 re databases 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


This is to clarify the requirements of the 1 2/20/2005 EC that was sent to all FBI divisions concerning FBI 
databases and a need to respond by January 13, 2006 with a description of such databases. 

ThA F C rsni liras de scriptions of d atabases that are used in field offices but that are Bureau-wide, such as 
I b nc | | We have decided that a more effi cient manner of obtaining the sam e b ; 

information is to ha vA a R innle H^d/'nfinn of SUCh databases, to includ e | ' E 

I la nd |~ I circulated among the field offices. It will be drafted here at headquarters ana 

Quantico. The field offices will simply need to state whether such descriptions are consistent with their 
particular operation and use of the database. If there are discrepancies, such discrepancies will have to be 
described. Hopefully, those descriptions will be circulated by the end of this week. 

There does remain the issue of access to those databases, which is particular to individual field offices. 
Therefore, field offices still need to respond to questions 7 through 9 of the EC, which focus upon access to 
the databases, and question 20, which focuses upon the audit trail. 

Further, the EC requires descriptions of all databases that are unique to the field offices. That 
requirement still stands, and all questions with respect to such databases {1 through 20) need to be answered. 

CDCs- please disseminate this to those people in your field office who have responsibility .for this project. 
Hopefully, this will eliminate a great deal of work on their part, but will still provide a clear and concise 
explanation of the databases, as well as any variations in operation or use that exist through the Bureau. 

If anyone has any substantive questions conc erning the r esponses, please contact OTD. For more 
general questions, feel free to contact me at (571 ) | | b s 

I l oGC/NSLB 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 



From: 

Sent: 

To: 

Subject; 


UNCLASSIFIED 

NON-RECORD 


Thanks, pik 

From: I aT> (FBI) 

Sent: Thursday, February 09, 2006 8:18 AM 

To: I lOGC) (FBI) 

Subject: nt P 1 

UNCLASSIFIED 

NON-RECORD 


Asked one of the Tech Agents, and he said no. 


I 1 

'Atlan ta Division- 1 

(404) | | 

— Original Message 

From: I K 3D I FBII 

Sent: Thurjfty, F^ry P9. 20068:13 AM 

To: I K AT) (FBI) 

Subject: 

UNCLASSIFIED 

NON-RECORD 


[- does the DCS-3000 have a more common or different name. I remember being told that but I can't think 
ot wnat it was. 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 



Fr 


To: I DGC) (FBI) *« 

Subject: Kfc: 

fo7C 

b'?E 

UNCLASSIFIED 

NON-RECORD 


The | | s a pen register collection system -similar to DSC-3000-but its older and doesn't do everything that DSC 3000 
does (fe.dj.' can’t understand pnd some of the other CALEA provided data), so I believe that it is being 

phased out 1 1 


-—-Original Message — 

From: I l OGQ (FBI) • 

Sent: * u 

To: 

Cc: 

Subject: 

UNCLASSIFIED 
NON-RECORD 


(OGC) (FBI) " 
(OGCXFBI) 


Thanks. How abou | | or a system labeled simply as I \ (by Baltimore)_ 

— Ori ginal Message- — 

From: | |(OGC) (FBI) 

Sent: I hursdav, PeSFuarv 09. 200 6 8:48 AM 

To: I I fOGO fFBIl 

Cc: I bCCF*) 

Subject htr 1 

UNCLASSIFIED 

NON-RECORD 


5b2 

be 

b7 

b7 


This is the risk with getting input from the field— it appears they didn't understand the question. The items below 
are not database systems that contain raw FIS A material (i.e. content) that must be minimized under the SMP 
(unless minimization applies to pen data and tc^ 1 




UNCLASSIFIED 

NON-RECORD 


Anyone know what DCS-3000, Penlink l | (l-1) are. These are all new ones that 

are coming up in the course of reading field office responses. 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 



From: 

Sent: 

To: 

Subject: 


I ~l (OGC) (FBI) 

Thursday, February 09, 2006 10:57 AM 

I I f OGC) (FBI) 

RE: 


UNCLASSIFIED 

NON-RECORD 


If you are able to access ! l it is 31 9X-HQ-1 487720, serial 86, the EC from Atlanta, it describes! 
pik L 


Thanks. 


b2 


— Original Message — 

From: I l OGQ (FBI) 

Sent: Ttimwlaw FPhniatv tlQ. 10:52 AM 

To: I (OGC) (FBI) 

Subject: htc 1 


b6 

b7C 

b'7E 


UNCLASSIFIED 

NON-RECORD 


I couldn't find anything through Google on l l -do you have any more information that can point me to the right 

unit?? 


Original Message — 


s. : 


KOGQ (FBI) 
1)9, il)06 8:51 AM 


Subject: RE: 


:) (FBI) 
3C)(FBI) 


UNCLASSIFIED 

NON-RECORD 


Thanks. How about £ 


3>r a system labeled simply a j ] (by BaltimoreL 


□(OGC) (FBI) 


Subject: 


Thursday, February 09, 2006 8:48 AM 
"lOGC) (FBI) 


qjjpexra 


UNCLASSIFIED 

NON-RECORD 


b2 


bS 

b7C 

b7E 


This is the risk with getting input from the field— it appears they didn't understand the question. The items 
below are not database systems that contain raw FISA rnaterial (i.e. content) that must be minimized under 
the SMP (unless minimization applies to pen data and to| | 


DCS-3000 is the Collection system for pen data-to the extent it collects content it's limited to SMS (text 
messages )-but it serves only as the collection point-the data is passed to another system (TA etc for 
analysis). 

PenLink is a software application that can be used 


to help analyze pen data. 


^ 1 ) appears to be a software application that can be used with Choicepoint According to 
is is software that can be installed on FBINET. It allows for the input of data for 
fen-link data can be imported into i2 Notebook.) 


thet6H6wmg link ( 

L. 


| (OGC) (FBI) 

ijjiy uy, ->uJ6 AM , 

J(OGC) (FBI) | fc XXXFBI) 


Anyone Know what DCS-3000, Penlin kl l l-l) are. These are all new ones 

that are coming up in the course of reading field office responses. 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 


UNCLASSIFIED 

NON-RECORD 


2 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


warded your email by Mobile ASAC Bill Lewis regarding our FISA collection/processing systems. 


Following are the 
Please note that the[ 
Pen Register data. 

DCS 3000 andr 

TAl 


' | >nd Pen Register systems (I 
<\ audio while the DCS 3000 (Wireless) ant 


rRnth n os ytnn and ! I 

idj I/Vireline; both contain 


_ _ ^Systems Administrator 

-Has been granted administrative privileges 
Was been granted administrative privileges 

^-Performs daily downloads of collected data for transfer to case agent 


Bystems Administrator 

Has been granted administrative privileges 

las been g ranted administrative privileges 

|(Retired TTA)-Has been granted administrative privileges for software and 


Please note that the CSOC at Quantico has been granted remote access to tbf 


Also note that we have an access point to the| |n Mobile and have the ability to route FISA audio 

to Language Services Division. To date we have not passed any audio through this system and have not used EDMS. 
Should you need any additional information, I can be reached at the following telephone numbers... Steve 


MOBILE DIVISION 
TECH NICAL ADVISOR 
DESKl 
CELL- 


SENSITIVE BUT UNCLASSIFIED 




From: I k OGC) (FBI) 

Sent: .Friday February u, 2Q05~5i28 PM 

To: | |(OGC) (FBI) 

Subject: Kt: More aataoases 


UNCLASSIFIED 

NON-RECORD 


Ifo6 

Thanks. From my point of view, it means NO MORE DESCRIPTIONS NEED TO BE ADDED from that list, at least. hie 

— Original Messacje^^_^_^ 

From: I b GC) (FBI) 

sent: r+hn*™ 17 7nnft-i-i7 pm 

To: | |(OGC) (FBI) 

subject: ' kb ! MWBaaBPM« 1 

UNCLASSIFIED 

NON-RECORD 


This is what I've learned from OTD: 


Most wireless carriers have centralized their CALEA delivery points. In most cases, CDC information (pen- 
register/trap-trace data) for all FBI intercepts per carrier are delivered to one FBI gateway per carrier. The 
locations of the gateways vary and depend on the location and connection restrictions imposed by the carriers. 

DCSnet is a peerless and private IP network that supports the delivery and transport of CALEA-enabled intercept 
product from the FBI gateways to all 56 FBI field offices. It is an unclassified network, and is not used to transfer 
processed/collected ELSUR information-Nor is it in itself a collection system-the collection system is the DCS-3000. 

The DCS-3000 is a suite of software applications that support the FBI's CALEA-based intercepts. This suite of 
applications has two primary functions: 1 ) a gateway between all carriers' delivery systems and the FBI's collection 
systems and centers (e.g., DCS-5000 in Atlanta Division), and 2) the primary collection system for all CALEA-enabled 
criminal pen-register and trap/trace intercepts. 

As I understand, the DCS-3000 serves as a gateway between carriers and the DCS-5000 system for security reasons. 
In essence, Security division will not allow a classified collection system to have connection to the outside-hence the 
DCS-3000 serves as the link and is for that purpose just a transport of the FISA material from the carrier to the DCS- 
5000 system. 

□ 


— Original Message — 

From: I l OGQ (FBI) 

Sent: Wednesday. Fehm aiv IS. 7006 1 1:04 AM 

To: I [ OGQ (FBI) 

Subject: More databases 

UNCLASSIFIED 

NO N-RECORD 


Have your heard of the Data Collection System Network (DCSNET) or the Rapid Prototyping Facility Network 
(RPFNET). Also , are DCS 3000 and DCS 5000 variations of each other, as far as pen register collection. 


I have reading a list of databases that the Security Division sent so that's where these issues are coming from. 
Thanks, pik 

UNCLASSIFIED 

UNCLASSIFIED 


UNCLASSIFIED 



DICLEMENTE, ANTHONY P. (OTD) (FBI); CLIFFORD, MICHAEL (OTD) 
(FBI) 


Subject: FW: Urgent request-DAG short-fused PI A tasking 

Importance: High 

UNCLASSIFIED 

NON-RECORD 


Attached please find electronic copies of the Privacy Threshold Analysis (PTA) forms for the four 
(4) Operational Technology Division systems identified as part of the twenty-eight (28) law 
enforcement systems on the FBI's 2006 FISMA inventory; specifically the Data Collection System 
3000 (DCS-3000), the Field Office Integrated Security System, the Computer Analysis Response 
Team Storage Area Network (CART SAN) and the Forensic Audio, Video and Image Analysis Unit 
Local Area Network (FAVIAU LAN). These are being forwarded to you per the June 5, 2006 e- 
mail attached below which requested they be forwarded to you "NLT" 6/9/06 (which was 

of business" 6/9/06 pursuant to a telephone conversation with OGC’s 




PTADC53000.wpd PTAFOISS.wpd (57 PTACARTSAN.wpd PTAFAVIAU.wpd 
(57 KB) KS) (62 KB) . (55 KB) 


The original copies of the PTAs concerning the DCS-3000 and the Field Office Integrated Security 
System where sent to your attention today via Bumail. It is my understanding that pursuant to 
telep hone conversations b etween the POCs for the CART SAN and FAVIAU LAN systems and 
1 the original copies for those two PTAs where sent directly to Ms 

I l/ia Bureau mail. 

Should you have any questions regarding this matter please don't hesitate to contact me. Thanks 


SSA | | 

Assistant Section Chief 
Technical Programs Section 
Ope rational Tec hnolonv Division 
17031 I 



Original Message 

From: | fcOGC) (FBI) On Behalf Of CAPRONI, VALERIE E (OGQ (FBI) 

Sent: l ~ " T? 5nday, June Djj, 

To: FBI_ADs and EADs 

Subject: Urgent request-DAG short-fused PIA tasking 


12 


Importance: High 

UNCLASSIFIED 

NON-RECORD 

I very much need your assistance to meet a short-fused, very high- visibility DAG tasking 
that the FBI received yesterday. The tasking relates to requirements by DOJ (passing 
down requirements by OMB) that agencies must on a quarterly basis certify 90% 
completion (for all FBI systems) of Privacy Impact Assessments (PIAs) required by 
Section 208 of the E-Govemment Act (E-Gov). To meet the two deadlines imposed by 
DOJ, we will need completed inputs by affected divisions by 6/9 and 6/21, as described 
below 

The FBI has been doing our own PIAs for years, and we have known about the changes 
looming under E-Gov for many months. Indeed, many of you probably have already 
encountered the effects in your own programs, such as increased emphasis on PIAs 
appearing in procurement/IT management processes, and DD Pistole's EC of 5/1 5/06 
(BUDED 6/5/2006) requiring each division to appoint a division privacy contact. We 
have, however, been long awaiting specific implementation guidance from DOJ, 
resolution of which was only recently provided thanks to the recent arrival of DOJ's new 
Chief Privacy and Civil Liberties Officer (Jane Horvath). This culminated in the 
5/30/2006 DAG memo which we received yesterday (TRIM 06/DO/3020) directing the 
FBI to focus on the 28 FBI Law Enforcement systems on the FBI’s 2006 FISMA 
inve nto^ (see attached). 

FISMA_LE_Spreads 

heet (version ... * . * 

The FBI must complete a Privacy Threshold Analysis (PTA) for each system and, where 
so indicated by the PTA, we must also complete at least a short-form PIA. 

OGC is responsible for coordinating the PIA process, and yesterday to meet this emergent 
requirement I directed internal detailing of OGC personnel to double our PIA-processing 
cadre, which will work exclusively on this tasking through completion. 

But I can’t emphasize strongly enough that PLA completion also depends on the absolutely 
essential contributions of knowledgeable program management in fully describing a 
system's structure, capabilities, and operations. Successful PIA completion thus must 
. always entail a collaborative effort with program management (which may span several 
divisions, e.g., the system builder(s) and its end user(s)), and it is to this end that I ask you 
to direct and support the provision of priority assistance from your affected system 
sponsors, project officers, and other personnel as may be required to complete this tasking 
within DOJ’s deadlines. 

To do this, we need divisions to complete PTAs for their systems NLT next Friday (6/9) 
and complete any required short-form PIAs NLT Wednesday 6/21. . 

- 13 • ‘ 



Unfortunately, the DOJ tasking also appears to require that we use newly implemented 
DOJ forms (attached for your reference are PTA and short-PLA forms): 



Privacy Threshold privacy_impact_ass 
. Analysis.Sho... essment_shor... 



Plus we need to submit the completed forms to DOJ for approval, which will require 
some departures from previous FBI SOP, and perhaps (and more irritatingly) some 
rewriting of previous drafts. (Hopefully, however, any previously prepared materials you 
may have prepared will prove susceptible to cutting/pasting into the new forms. And who 
knows, it may even be that, once the initial kinks are worked out, the new PIA process 
might even help make it easier and/or faster to complete and process PIAs., which would 
be nice, because there surely are more PIAs is all our futures.) 

By separate e-mails, OGC's PIA staff will be communicating directly with the persons 
identified as POCs for each of the 28 FBI systems affected by this tasking. We will . 
provide the divisionprogram POCs with the necessary forms for the program to complete 
(plus some additional questions we need for our review), and we will identify a 
designated OGC attorney to be OGC’s POC for eachsystem who will work with the 
division POCs to "smooth" the form(s) within the deadline(s). 

My overall coor dinator for this tasking is Senior Assistant General Counse f" | 

I [ 202-3 24CHZ1 (Not e there y e now 3| h the FBI. ! i nternal >6 

: e-mail ad dress isl Ih e only one in OGC). and his Int ernet e-mail h/( : 

address _ | Ple ase don’t h esitate to contact! | my Deputy 

Pat Kelley (202-324- 1 | orme (202-3 2 f~ | you have any questions. Thanks in 

advance for your support ! . 

vc ' : • - 


14 


UNCLASSIFIED 




• m 



PTADCS3000.wpd 
(57 KB) 





DIC LEMENTE- ANTHONY P. fOTD) /F BI); CLIFFORD. MICHAEL (OTD1 
(FBI J l OGC) (FBI) 

Subject: RE: Urgent request-DAO short-fused PIA tasking 

UNCLASSIFIED 

NON-RECORD 





Subject: FW: Urgent request-DAG short-fused PIA tasking 

Importance: High 


UNCLASSIFIED 

NON-RECORD 



Attached please find electronic copies of the Privacy Threshold Analysis (PTA) forms for the four (4) 
Operational Technology Division systems identified as part of the twenty-eight (28) law 
enforcement systems on the FBI's 2006 FISMA inventory; specifically the Data Collection System 
3000 (DCS-3000), the Field Office Integrated Security System, the Computer Analysis Response 
Team Storage Area Network (CART SAN) and the Forensic Audio, Video and Image Analysis Unit 
Local Area Network (FAVIAU LAN). These are being forwarded to you per the June 5, 2006 e-mail 
attached below which requested they be forwarded to you "NLT' 6/9/06 (which 
business" 6/9/06 pursuant to a telephone conversation with 




« File: PTADCS3000.wpd » << File: PTAFOISS.wpd » « File: PTACARTSAN.wpd » « 
File: PTAFAVIAU.wpd » 

The original copies of the PTAs concerning the DCS-3000 and the Field Office Integrated Security 
System where sent to your attention today via Bumail. It is my understanding that pursuant to 



tween the POCs for the CART SAN and FAVIAU LAN systems and 
he original copies for those two PTAs where sent directly to Ms 


Should you have any questions regarding this matter please don't hesitate to contact me. Thanks 


cm 



Assistant Section Chief 
Technical Programs Section 



Original 

From: 

Sent: 

To: 

Subject: Urgent request-OAG short-fused PIA tasking 

Importance: High 

UNCLASSIFIED 

NON-RECORD 

I very much need your assistance to meet a short-fused, very high-visibility DAG tasking 
that the FBI received yesterday. The tasking relates to requirements by DOJ (passing down 
requirements by OMB) that agencies must on a quarterly basis certify 90% completion (for 
all FBI systems) of Privacy Impact Assessments (PLAs) required by Section 208 of the 

•• 22 , . v: ■ ■ 


TOGQ (FBI) On Behalf Of CAPRONI, VALERIE E. (OGQ (FBI) 


.E-Government Act (E-Gov). To meet the two deadlines imposed by DOJ, we will need 
completed inputs by affected divisions by 6/9 and 6/2 1 , as described below . 

The FBI has been doing our own PLAs for years, and we have known about the changes 
looming under E-Gov for many months. Indeed, many of you probably have already 
encountered the effects in your own programs, such as increased emphasis on PIAs 
appearing in procurement/IT management processes, and DD Pistole's EC of 5/15/06 
(BUDED 6/5/2006) requiring each division to appoint a division privacy contact. We have, 
however, been long awaiting specific implementation guidance from DOJ, resolution of 
which was only recently provided thanks to the recent arrival of DOJ’s new Chief Privacy 
and Civil Liberties Officer (Jane Horvath). This culminated in the 5/30/2006 DAG memo 
which we received yesterday (TRIM 06/DO/3020) directing the FBI to focus on the 28 FBI 
Law Enforcement systems on the FBI's 2006 FISMA inventory (see attached). 

« File: FISMA_LE_Spreadsheet (version 2) fin Susan 5-30-06.xls » 

The FBI must complete a Privacy Threshold Analysis (PTA) for each system and, where so 
indicated by the PTA, we must also complete at least a short- form PIA. 

OGC is responsible for coordinating the PIA process, and yesterday to meet this emergent 
requirement I directed internal detailing of OGC personnel to double our PIA-processing 
cadre, which will work exclusively on this tasking through completion. 

. But I can’t emphasize strongly enough that PIA completion also depends on the absolutely 
essential contributions of knowledgeable program management in fully describing a 
• system's structure, capabilities, and operations. Successful PIA completion thus must 
always entail a collaborative effort with program management (which may span several 
divisions, e.g., the system builder(s) and its end user(s)), and it is to this end that I ask you 
to direct and support the provision of priority assistance from your affected system 
sponsors, project officers, and other personnel as may be required to complete this tasking 
within DOJ’s deadlines. 

To do this, we need divisions to complete PTAs for their systems NLT next Friday (6/9) 
and complete any required short-form PIAs NLT Wednesday 6/21 . 

Unfortunately, the DOJ tasking also appears to require that we use newly implemented . 
DOJ forms (attached for your reference are PTA and short-PLA forms): 

« File: Privacy Threshold Analysis. Short.Form.PIA.wpd » «File: 
privacy_impact_assessment_short form template_90 cert.doc » 

/The long PIA form is here: • 

Completion guidance is here: - “ 


Plus we need to submit the completed forms to DOJ for approval, which will require some 
departures from previous FBI SOP, and perhaps (and more irritatingly) some rewriting of 
previous drafts. . (Hopefully, however, any previously prepared materials you may have 



prepared will prove susceptible to cutting/pasting into the new forms. And who knows, it 
may even be that, once the initial kinks are worked out, the new PIA process might even 
help make it easier and/or faster to complete and process PlAs., which would be nice, 
because there surely are more PIAs is all our futures.) 

By separate e-mails, OGC's PIA staff will be communicating directly with the persons 
identified as POCs for each of the 28 FBI systems affected by this tasking. We will provide 
the division program POCs with the necessary forms for the program to complete (plus 
some additional questions we need for our review), and we will identify a designated OGC 
attorney to be OGC’s POC for each system who will work with the division POCs to 
"smooth” the form(s) within the deadline(s). 

My ove rall coor dinator for this tasking is Seni or Assistant Gener al C.mmsejl \ 

j [ 202-32^1 I fNnte there ^tp now 3| |n the FBI. | I nternal 

e -mail address il p e only one m uvjio. a na his I nternet e-mail address 

is | | P lease d on’t hesitate to contac j |m y Deputy Pat Kelley 

(202-32 4 I . or me 1202-3241 I if you have any questions. Thanks in advance for 
your support! 

vc _ 


UNCLASSIFIED 

UNCLASSIFIED 



FY08-030 




FY08-031 SMIS 

Completed 

10/10/05 


Need to publish 

FY08-032 FBI Digital Collection 
(DCS-3000, DCS-5000 and 
DCS-6000) 

N/NSS 


Collects audio, microphone, and fax intercepts. A PIA is not required pursuant 
to the E-Government Act because the FBI's Digital Collection Systems are 
considered national security systems. However, the FBI conducts internal 
PIAs on all national security systems to ensure that privacy rights are 
adequately considered in system development. A PIA was conducted and 
approved 8/27/2001 for the digital collection systems. OTD performed an 
upgrade to the system in Jujy of 2005. By EC dated 12722/2005, OGC advised 
that a supplemental PIA was not required, and that OGC should be consulted 
for any subsequent upgrades. 

FY08-033 Administrative Systems 
Support ' 

Yes, unless it 
isaNSS 

Required. Possibly 
coverd by existing 
butmayneed 

Will contain, among other things, BPMS & Personnel Background Mgmt 
System, both of which would contain personal info. 

FY08-034 




FY08-035 . 



•fob ■ ‘ . ‘ '■ ’ *. 

FY08-036 Network Services 



b7C .' 

FY08-037 Records Management 
Application 

N/NSS 

Required. Exists 
but may need ' 
update 

NSS (according tcf"*""* lharf) . . ' ' ; .• ■ ; 

FY08-038 




FY08-039 Operations Test and 
Evaluation Facility 

Not required 

; Not required 

As presented in the Exhibit 300, this investment will, provide the FBI with an 
environment isolated from but representative of the FBI operational 
environment, for the conduct of independent verification and validation of all 
new or enhanced IT systems to be used within the FBI. No PIA is required for 
the establishment of OTEF, since of itself the OTEF is merely a testing 
environment that does not per se constitute a personal-information system or 
collection; indeed we would anticipate that many of the actual tests conducted 
would not involve personally identifiable information,, e.g., if the tests merely 
involved technical stressing of an application or dummy data. (Note, though, 
that acquisition of the functionality being tested might require a PIA by the 
acquisition sponsor.) PIAs might be required for specific OTEF tests if the 
testing entailed OTEFs access to non-minor amounts of personally identifiable 
real data. (But even in such cases, it may be the most pragmatic solution 
would be to satisfy any PIA requirements by addressing OTEF testing in the 
underlying PIA for the system or procurement being tested.) 

FY08-040 
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Subject: 

UNCLASSIFIED 

NON-RECORD 


niCI FMFNITF ANTHONY. P fOTn t IFRIV Cl IFFf 
(FBI) I (ITD) (FBl| 

(CON) 

RE: Urgent request-DAG short-fused PIA tasking 


|(OGC) (FBI) 
f(OTD) (OGA); 
1CHAFI ( DTD1 

I (OTP) ■ 


My contacts f or CARTSAN an d t he Forensic Aud io. Video and Image Analysis Unit Local Area 
. Network we rel ~kndl I Both were superb in their efforts to assist me 

with this project. Many thanks to all. 



Assistant General Counsel 
Adminis trative Law Unit, Room 7338 
202-3241 I 


THIS IS A PRIVILEGED COMMUNICATION AND IS NOT TO BE DISTRIBUTED WITHOUT 
PRIOR OGC APPROVAL 


From: | PTD) (FBI) 

Sent- Friday. June 09. 2005 lP:4o AM 
To; | | (QGC) fFBil 

CC3 I HUMaJj, MAKLUb u (OTD) (FBl l 

(OTD) (FBI); CUFFORD, MICHAEL (OTD) (FBI) 
Subject: FW: Urgent request-DAG short-fused PIA tasking 

Importance: High 

UNCLASSIFIED 

NON-RECORD 


JOGQ (FBI) 

(OTD) (OGA); DICLEMENTE, ANTHONY P. 


Attached please find electronic copies of the Privacy Threshold Analysis (PTA) forms for the 
four (4) Operational Technology Division systems identified as part of the twenty-eight (28) 
law enforcement systems on the FBI's 2006 FISMA inventory; specifically the Data Collection 
System 3000 (DCS-3000). the Field Office Integrated Security System, the Computer Analysis 
Response Team Storage Area Network (CART SAN) and the Forensic Audio, Video and 
Image Analysis Unit Local Area Network (FAVIAU LAN). These are being forwarded to you 
per the June 5, 2006 e-mail attached below which requested they be forwarded.to you "NLT” 
6/9/06 (which was deter mine to mean "bv close o f business" 6/9/06 pursuant to a telephone 
* conversation with OGC's | .. 


< File; PTADCS30Q0.wpd > 


< File: PTAFOISS.wpd > 


c File. PT ACARTSAN.wpd > 




« File: PTAFAVIAU.wpd >> • 

The original copies of the PTAs concerning the DCS-3000 and the Field Office integrated 
Security System where sent to your attention today via Bumail. It is my understanding that 
pursuant to telepho ne conversations bet ween the POCs for the CART SAN and FAVIAU LAN 
systems a nd OGC' j j the original copies for those two PTAs where sent 

directly to I ha Bureau man 


Should you have any questions regarding this matter please don't hesitate to contact me. 
Thanks 


Assistant section Chief . 
Technical Programs Section 
. Operatio nal Technolo gy Division 
(703)633 — L- 


"b6 

lb 7 


Original Message 

From: | pGC) (FBI) On Behalf Of CAPRONI, VALERIE E. (OGQ (FBI) 

Sent: 1 Monday, June (IS, Mfl6T 5BTM 

To: FBI_ADs and EADs 

Subject: Urgent requeSt-OAG short-fused PIA tasking 

Importance: High _• ‘ • 

UNCLASSIFIED b. 

NON-RECORD 

I very much need your assistance to meet a short-fused, very high- visibility DAG 
tasking that the FBI received yesterday. The tasking relates to requirements by DOJ. 
(passing down requirements by OMB) that agencies must on a quarterly basis certify 
90% completion (for all FBI systems) of Privacy Impact Assessments (PIAs) required 
by Section 208 of the E-Govemment Act (E-Gov). To meet the two deadlines 
imposed by DOJ, we will need completed inputs by affected divisions by 6/9 and 
6/21, as described below . 

The FBI has been doing our own PIAs for years, and we have known about the 
changes looming under E-Gov for many months. Indeed, many of you probably have 
already encountered the effects in your own programs, such as increased emphasis on 
PIAs appearing in procurement/IT management processes, and DD Pistole's EC of 
5/15/06 (BUDED 6/5/2006) requiring each division to appoint a division privacy . 
contact. We have, however, been long awaiting specific implementation guidance 
from DOJ, resolution of which was only recently provided thanks to the recent arrival 
of DOJ's new Chief Privacy and Civil Liberties Officer (Jane Horvath). This 
culminated in the 5/30/2006 DAG memo which we received yesterday (TRIM 
06/DO/3020) directing the FBI to focus on the 28 FBI Law Enforcement systems on 
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the FBI's 2006 FISMA inventory (see attached). 

« File: FISMA_LE_Spreadsheet (version 2) fin Susan 5-30-06.xls » . 

The FBI must complete a Privacy Threshold Analysis (PTA) for each system and, 
where so indicated by the PTA, we must also complete at least a short-form PIA. 

OGC is responsible for coordinating the PIA process, and yesterday to meet this 
emergent requirement I directed internal detailing of OGC personnel to double our 
PIA-processing cadre, which will work exclusively on this tasking through 
completion. 

But I can't emphasize strongly enough that PIA completion also depends on the 
absolutely essential contributions of knowledgeable program management in fully 
describing a system's structure, capabilities, and operations. Successful PLA 
completion thus must always entail, a collaborative effort with program management 
(which may span several divisions, e.g., the system builders) and its end user(s)), and 
it is to this end that I ask you to direct and support the provision of priority assistance , 
from your affected system sponsors, project officers, and other personnel as may be 
required to complete this tasking within DOJ's deadlines. 

To do this, we need divisions to complete PTAs for their systems NLT next Friday 
(6/9) and complete any required short-form PLAs NLT Wednesday 6/21. 

Unfortunately, the DO J tasking also appears to require that we use newly 
implemented DOJ forms (attached for your reference are PTA and short-PlA forms): 
« File: Privacy Threshold Analysis.Short.Fqrm.PIA.wpd » « File: ; 
privacy_impact_assessment_short form template_90 cert.doc » 

(The long PIA form is here: : - ■ ' . ' ' . • - 



Ill ETllWvfl 


Plus we need to submit the completed forms to DOJ for approval, which will require 
some departures from previous FBI SOP, and perhaps (and more irritatingly) some 
rewriting of previous drafts. (Hopefully, however, any previously prepared materials 
you may have prepared will prove susceptible to cutting/pasting into the new forms. 
And who knows, it may even be that, once the initial kinks are worked out, the new 
PIA process might even help make it easier and/or faster to complete and process 
PLAs., which would be nice, because there surely are more PIAs is all our futures.) , 

By separate e-mails, OGC's PIA staff will be communicating directly with the persons 
identified as POCs for each of the 28 FBI systems affected by this tasking. We will 
provide the division program POCs with the necessary forms for the program to 
complete (plus some additional questions we need for our review), and we will . 
identify a designated OGC attorney to be OGC's POC for each system who will work 
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with the division POCs to "smooth" the form(s) within the deadline(s). 

Mv overal l coordi nator for t his tasking is Senior Assistant General C ounsel I 

I l f202-324 | ’ IfNntf: ih eia fire np w \ In the FB| | 

. internal e-mai 1 address is| _|the only one in OGC), and his Intern et e- 

mail address is | Please don't he sitate to contact |~~| my 

Deputy Pat Kelley (202 -324- j [ or me (202-324- | | ifyou have any questions. 

Thanks in advance for your support’ 

VC 


UNCLASSIFIED 


UNCLASSIFIED 


From: 

Sent: 

To: 


Subject: 

UNCLASSIFIED 

NON-RECORD 


; Friday. June Q9, 




U>TD)(FBI) / 


UO 


| |(OGC) (FBI) _ 

; THOMAS, MARCUS C. (OTD) (FB1);|_ 


□(OGC) (FBI); 
□(OTD) (OGA); 


Dici FMFNTF ANTHONY P (OTP) /FBI); CLIFFORD,. MICHAEL (OTD) 
VFRMl ItOGCA (FBI) 

RE; Urgent request-DAG short-fused PIA tasking 


□ 


.Thank you very much! After the dust settles, let me know what you want us to do and it will be 
handled ' 

Have a great weekend. • 


o 


FYI - Please,not ^ [ comments regarding the PTA for the CARTSAN. I’ll keep you posted. 


ssa 

■ Assi5 

• Technical Programs Section 


Operatio nal Techno logy Division 

m 1 ... 


ozmM. 


L 


13X30 (FBI) 

?nnfi 4:on p m 

> TP) (FBI)C 


' THOMAS, MARCUS C. (OTD) (FBI)|. 


□OGQ (FBI)j 


IfOTD) (OGA): DICLEMEN TE. ANTHONY P. (OTD) 
(FBI); CLIFFORD, MICHAEL (OTD) (FBI] fGC) (FBI) 

Subject: RE: Urgent request-DAG short-fused PIA tasffllit) 11 1 1 


UNCLASSIFIED 

NON-RECORD 




Senior Assistant General Counsel 
Administrative Law Unit, OGC 
.203-32-1 I Room 7338 JEH 

P S. The FBI is now blessed with threej 
in OGC. L 


: From: I h rni (friv 

Sent: Fnday. June 09, 20Q6 10:40 AM , . . 

To: I If OGC) fF8 I);l 

Cc: THOMAS, MARCUS C (OTD) (FBlI 

(FBI); CLIFFORD, MICHAEI?(UIUJ (FBI) 
Subject: FW: Urgent request-DAG short-fused PIA tasking 

: Importance: High 

UNCLASSIFIED 

NON-RECORD 


B lGQ(FBr) 

faTT>) (OGA); DICLEMENTE, ANTHONY P. (OTD) 


Attached please find electronic copies of the Privacy Threshold Analysis (PTA) forms for the 
four (4) Operational Technology Division systems identified as part of the twenty-eight (28) law 
enforcement systems on the FBI's 2006 FISMA inventory; specifically the Data Collection 
System 3000 (DCS-30.00), the Field Office Integrated Security System, the Computer Analysis 
Response Team Storage Area Network (CART SAN) and the Forensic Audio, Video and Image 
Analysis Unit Local Area Network (FAVIAU LAN). These are being forwarded to you per the 
June 5, 2006 e-mail attached beiow which requested they be forwarded to you ”NLT' 6/9/06 
(which was determine t o mean "by close of busines s" 6/9/06 pursuant to a telephone 
conversation with OGC'I I 


< File: PTACARTSAN .wpd > 


« File: PTADCS3000.wpd » « File: PTAFOISS.wpd » « File: PTACARTSAN .wpd > 
« File: P I AFAVIAU.wpd » • 

The original copies of the PTAs concerning the DCS-3000 and the Field Office Integrated 




Security System where sent to your attention today via Bumail. -It is my understanding that , 
pursuant to telep.nona rnnwareahnnc hataveen the POCs for the CART SAN and FAVIAU LAN / 
systems and QGC'sj | he original copies for those two PTAs where sent 

■ directly tc j | ia Bureau mail: '■ 

Should you have any questions regarding this matter please don’t hesitate to contact me. 

Thanks - •/ • 


□ 

ssC 


. Assistant Section Chief 
Technical Programs Section . 
: Ope rational Ter.h nnlnnv Division 

-tznaL L . 


— - Ongtnal Message-- ■ ■ . 

From: I « OGQ (FBI) On Behalf Of CAPRONI, VALERIE £. (OGQ (FBI) 

Sent: Monday, June OS, 2006 3:50 PM 

To: . F8I_ADs and EADs 

Subject: • Urgent request-DAG short-fused PIA tasking 

Importance: High 

UNCLASSIFIED ‘ « V,3-: 

NON-RECORD • - 


I very much need your assistance to meet a short-fused, very high-visibility DAG \. 

tasking that the FBI received yesterday. The tasking relates to requirements by DOJ 
(passing down requirements by OMB) that agencies must on a quarterly basis certify 
90% completion (for all FBI systems) of Privacy Impact Assessments (PIAs) required 
by Section 208 of the E-Government Act (E-Gov). To meet the two deadlines imposed 
by DOJ, we will need completed inputs by affected divisions by 6/9 and 6/21, as 
described below . ' ; • • . ■ • / V 

The FBI has been doing our own PIAs for years, and we have known about the changes 
looming under E-Gov for many months. Indeed, many of you probably.have already 
encountered the effects in your own programs, such as increased emphasis on PIAs 
appearing in pi ocurement/IT management processes, and DD Pistole's EC of 5/15/06 
(BUDED 6/5/2006) requiring each division to appoint a division privacy contact. We. 
have, however, been long awaiting specific implementation guidance from DOJ, 
resolution of which was only recently provided thanks to the recent arrival of DOJ’s 
new Chief Privacy and Civil Liberties Officer (Jane Horvath). This culminated in the 
5/30/2006 DAG memo which we received yesterday (TRIM 06/DO/3020) directing the A 
FBI to focus on the 28 FBI Law Enforcement systems on the FBI's 2006 FISMA 
inventory (see attached). , . • 

« File: FISMA_LE_Spreadsheet (version 2) fin Susan 5-30-06.xls » 

The FBI must complete.a Privacy Threshold Analysis (PTA) for each system and, 
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where so indicated by. the PTA, we must also complete at least a short-form PIA. 


OGC is responsible for coordinating the PIA process, and yesterday to meet this 
emergent requirement I directed internal detailing of OGC personnel to double our 
PlA-processing cadre, which will work exclusively on this tasking through 
completion. .. •• * ' . / 

But I can’t emphasize strongly enough that PLA completion also depends on the 
absolutely essential contributions of knowledgeable program management in fully 
describing a system's structure, capabilities, and operations. Successful PIA 
completion thus must always entail a collaborative effort with program management 
(which may span several divisions, e.g., the system builder(s) and its end user(s)), and 
it is to this end that I ask you to direct and support the provision of priority assistance 
from your affected system sponsors, project officers, and other personnel as may be 
required to complete this tasking within DOJ's deadlines. 

To do this," we need divisions to complete PTAs for their systems NLT next Friday (6/9) 
and complete any required short-form PLAs NLT Wednesday 6/21 . 

Unfortunately, the DOJ tasking also appears to require that we use newly implemented 
DOJ forms (attached for your reference are PTA and short-PLA forms): 

• .<< File: Privacy. Threshold Analysis. Short.Form.PIA.wpd » << File: 
privacy_impact_assessment_short form template_90 cert.doc » 

.(The lfinp PIA form'ifi here; - , • : • 


Plus we need to submit the completed forms to DOJ for approval, which will require 
some departures from previous FBI SOP, and perhaps (and more irritatingly) some 
rewriting of previous drafts. (Hopefully, however, any previously prepared materials 
you may have prepared will prove susceptible to cutting/pasting into the new forms. 
And who knows, it may even be that, once the initial kinks are worked out, the new 
PIA process might even help make it easier and/or faster to complete and process 
, PIAs., which would be nice, because there surely are more PLAs is all our futures.) 

By separate e-mails, OGC’s PIA staff will be communicating directly with the persons 
identified as POCs for each of the 28 FBI systems affected by this tasking. We will 
provide the division program POCs with the necessary forms for the program to 
complete (plus some additional questions we need for our review), and we will identify 
a designated OGC attorney to be OGC’s P.OC for each system who will work with the 
division POCs to "smooth" the form(s) within the deadline(s). 

Mv ove rall coor dinator for this tasking is Seni or Assistant Gener al Counse l! 

I |(2Q2-324-| | (Note there are now | j in the FB j | 
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UNCLASSIFIED 

UNCLASSIFIED 


UNCLASSIFIED 
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System Name 

PTA 

3 

Campus WAN 

Campus WAN 

4 

Chemical Network (ChemNet) 

ChemNet 

5 

CJIS WAN 

CJIS WAN 

6 

Combined DNA Index System 
(CODIS) 

N/A (PIA previously conducted) 

7 

Commercial Payments Unit 
Invoice Management System 
(CPUIMS) 

CPUIMS ' . 

8 

Computer Analysis Response 
Storage Area Network, 
(CARTSAN) 

CARTSAN . 

9 

CYBERTRANS II 

CYBERTRANS II 

10 

Data Collection System 3000 
(DCS-3000) 

DCS-3000 

11 

Digital Document 
Management System (DDMS) 

DDMS 

12 

Document Capture System 

Document Capture System 

13 

Financial Management System 
(FMS) 

FMS • 

14 

Field Office. Integrity Security 
i System (FOISS) 

FOISS 

15 

1 Forensic Audio, Video, and 
Image Analysis (F AVIA) 
LAN 

FA VIA LAN ... 

16 

Innocent Images Case 
Management System (IICMS) 

N/A (PIA previously conducted) 

17 

Integrated Automated 
Fingerprint Identification 
System (IAFIS) 

3 PTAs: 

(1) interim Data Sharing Model (iDSM) 

(2) Composite PTA for following future components of Next Generation 
IAFIS (NGI): 

Enhanced IAFIS Repository; 

Advanced Fingerprint Identification Technology (AFIT) 

(including the Enhanced Terrorist Identification Service (ETIS)); 
. National Palm Print System (NPPS); 

National Security Interest File (NSIF); and 
Interstate Photo System (IPS) 

(3) Current national security enhancements - 

18 

Law Enforcement Online . 
: (LEO) 

LEO ; 

19 

National Crime Information 
Center (NCIC) 

Violent Gang and Terrorist Organization File (VGTOF) 





From: 


| _JOTD) (CON) 

Sent: Friday, November 04 , 2005 7:47. AM 

To: 1 l OGC) (FBI) i. 

Cc: | t OTD) (FBI) 

Subject: Digital Collection description 


UNCLASSIFIED 

NON-R E CORD 


I I Hope this provides what you need. If not, please let me know. If you need a more succinct or technical 

1 " HK C n p ro h, I'll provide it 

Glad we finally met. Thanks for your hel j | 


Digital Collection consists of the DCS-3000, DCS-5000, and DCS-6000, which provide digital collection tools, foreign 
counterintelligence gathering, and law enforcement evidence collection, respectively. Digital Collection supports the FBI's 
mission to ensure the ability of the FBI to collect evidence and intelligence through the acquisition, deployment, and support 
of communications interception techniques and systems to facilitate and support national security, domestic counterterrorism, 
and criminal investigative efforts. Systems being acquired under the Digital Collection program include systems (foreign 
counterintelligence and law enforcement) that possess similar functions and capabilities to intercept telephone, microphone, 
and facsimile communications; however, the primary difference is law enforcement system’s. requirement to minimize 
collected communications. The passage of the Communication Assistance to Law Enforcement Act (CALEA), the 
implementation of state-of-the-art personal security features, and the explosion of telecommunication options (caller ID, call 
waiting, call conferencing, etc.) spotlighted the deficiencies of the legacy systems. 

The Digital.Collection Program provides the FBI with the means to collect evidence and intelligence through the acquisition, 
deployment, and support of communications interception techniques and systems which facilitate and support national 
security, domestic counterterrorism, and criminal investigative efforts. Systems provided through this program intercept 
multi-source digital (and analog) communications information for intelligence gathering for foreign counterintelligence 
activities and investigative purposes for providing evidence of criminal activity for trial. It should be noted that those systems 
used for criminal investigations possess a requirement to minimize intercepted voice sessions, (i.e., record only when the call 
is being actively monitored). Electronic information collected includes pen register (incoming and outgoing dialed digits, 
caller identification, date/time of communication, and other signal related information), analog and digital telephone calls, 
facsimile and modem transmissions, and microphone audio. High density drives and magneto-optical disks are utilized for 
temporary and permanent storage, respectively; no special, environmental storage facilities are needed. Digital Collection 
systems are used primarily by FBI field offices and Resident Agencies in support of active foreign intelligence and criminal 
cases. Support is also provided to other federal, state, local and tribal agencies, as required. . 

The Digital Collection Program has evolved during its life cycle and has become more complex. Even so, digital collection 
systems are computer-based systems comprised primarily of commercial-off-the-shelf hardware and software with limited 
proprietary application software. Incorporated technological advances allow Case Agents to easily and effectively manage 
the recordings electronically, which dramatically increases the efficiency of trial preparations. While each Field Office or 
Resident Agency is self-sustaining m its ability to process intercepted information, this program permits interconnectivity of 
all FCl systems via I B wide area network established to link field offices’ central monitoring plants for the 

purpose of digital collection information sharing; it will use Trilogy’s network backbone.) and TRILOGY (the FBI’s 
enterprise wide area network being deployed to link field offices). This connectivity enables the transfer of electronic or ; 

digital files of intercepts to a remote or distant field office for special language translation/transcription and sharing of 
information among FBI offices and other partnering agencies. Systems are also installed as fixed systems in locations that 
require long-term, permanent operations. In many instances, intercepted audio is shared via a secure, wide area network or 
downloaded from computer memory onto removable media and provided to language specialists in offices around the 
country, greatly increasing productivity of FBI translation and transcription efforts. 


UNCLASSIFIED 



Message ’ £ . ^ -Pwgn 1 afj. 

productivity of FBI translation and transcription efforts. 

V UNCLASSIFIED 


UNCLASSIFIED 



U NCLASS IFIED 


11/10/2005 


Subject: Digital' Collection description 


le-mails.txt 


UNCLASSIFIED 
NON -RECORD 


-Hope this provides what you need, if not, please let me know. If you 
re succinct or technical description, I’ll provide it. 


Glad we finally met. Thanks for your 


help, | | 


Digital Collection consists of the DCS-3000, DCS-SOOO, and DCS-6000, which provide 
digital collection tools, foreign counterintelligence gathering, and law enforcement 
evidence collection, respectively. Digital Collection supports the FBI's mission to 
ensure the ability of the FBI to collect evidence and intelligence through the 
acquisition, deployment, and support of communications interception techniques and 
systems to facilitate and support national security, domestic counterterrorism, and 
criminal investigative efforts. Systems being acquired under the Digital Collection 
program include systems (foreign counterintelligence and law enforcement) that 
possess similar functions and capabilities to intercept telephone, microphone, and 
facsimile communications; however, the primary difference is law enforcement 
system's requirement to minimize collected communications. The passage of the 
communication Assistance to Law Enforcement Act (CALEA), the implementation of 
state-of-the-art personal security features, and the explosion of telecommunication 
options (caller ID, call waiting, call conferencing, etc.) spotlighted the 
deficiencies of the legacy systems. 


The Digital collection Program provides the FBI with the means to collect evidence 
and intelligence through the acquisition, deployment, and support of communications 
interception techniques and systems which facilitate and support national security, 
domestic counterterrorism, and criminal investigative efforts, systems provided 
through this program intercept multi-source digital (and analog) communications 
information for intelligence gathering for foreign counterintelligence activities 
and investigative purposes for providing evidence of criminal activity for trial. It 
should be noted that those systems used for criminal investigations possess a 
requirement to minimize intercepted voice sessions, (i.e., record only when the call 
is being actively monitored). Electronic information collected includes pen 
register (incoming and outgoing dialed digits, caller identification, date/time of 
communication, and other signal related information), analog and digital telephone 
calls, facsimile and modem transmissions, and microphone audio. High density drives 
and magneto-optical disks are utilized for temporary and permanent storage, 
respectively; no special, environmental- storage facilities are needed. Digital 
collection systems are used primarily by FBI field offices and Resident Agencies in 
support of active foreign intelligence and criminal cases. Support is also provided 
to other federal, state, local ana tribal agencies, as required. 


The Digital Collection Program has evolved during its life cycle and has become more 
complex. Even so, digital collection systems are computer-based systems comprised 
primarily of commercial -off-the-shelf hardware and software with limited proprietary 
application software, incorporated technological advances allow case Agents to 
easily and effectively manage the recordings electronically, which dramatically 
increases the. efficiency of trial preparations, while each Field office or Resident 
• ; ■ page 56 - 
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Agency is self-sustaining in its abi lity to process inte rcepted in formation, this 
Droaram oermits interconnectivity of all FCI systems viai | (a wide area 

network established to link field offices’ central monitoHhg plants for the purpose 
of digital collection information sharing; it will use Trilogy’s network backbone.) 
and TRILOGY (the FBI’s enterprise wide area network being deployed to link field 
offices). This connectivity enables the transfer of electronic or digital files of 
intercepts to a remote or distant field office for special language , 
translation/transcription and sharing of information among FBI offices and other 
partnering agencies, systems are also installed as fixed systems in locations that 
require long-term, permanent operations. In. many instances, intercepted audio is 
shared via a secure, wide area network or downloaded from computer memory onto 
removable media and provided to language specialists in offices around the country, 
greatly increasing productivity of FBI translation and transcription efforts. 


UNCLASSIFIED 



Digital Collection consists of the DCS-3000, DCS-5000, and DCS-6000, which provide 
digital collection tools, foreign counterintelligence gathering, and law enforcement 
evidence collection, respectively. Digital collection supports the FBI's mission to 
ensure the ability of the FBI to collect evidence and intelligence through the 
acquisition, deployment, and support of communications interception techniques and 
systems to facilitate and support national security, domestic counterterrorism, and 
criminal investigative efforts. Systems being acquired under the Digital Collection 
program include systems (foreign counterintelligence and law enforcement) that 
possess similar functions and capabilities to intercept telephone, microphone, and 
facsimile communications; however, the primary difference is law enforcement 
system’s requirement to minimize collected communications. The passage of the 
Communication Assistance to Law Enforcement Act (CAL FA) , the implementation of 
'state-o^the-art personal security features, and the explosion of telecommunication 
options (caller id, call waiting, call conferencing, etc.) spotlighted the 
deficiencies of the legacy systems. 


The Digital Collection program provides the FBI with the means to collect evidence 
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FY08-032 FBI Digital Collection 
(DCS-3000, DCS-5000 and DCS-6000) 

Completed. 

CRS 

Collects audio, microphone, and fax intercepts. A PIA is not required pursuant 
to the E-Govemment Act because the FBI’s Digital Collection Systems are 
considered national security systems. However, the FBI conducts internal 
PlAs on all national security systems to ensure that privacy rights are 
adequately considered in system development. A PIA was conducted and 
approved 8/27/2001 for the digital collection systems. OTD performed an ■ ; 
upgrade to the system in July of 2005. By EC dated 12/22/2005, OGC advised 
that a supplemental PIA was not required, and that OGC should be consulted 
for any subsequent upgrades. 

FY08-033 Administrative Systems 
Support ■ ' 

Yes, unless it 
is a NSS 

Required. Possibly 
covered by existing 
but may need 

Will contain, among other things, BPMS & Personnel Background Mgmt 
System, both of which would contain personal info. 

FY08-034 IDW Base 

Y 

ois 5 . 

Funding is requested to continue to expand and extend the set of ID W services 
and data provided. A PIA is not required pursuant to the E-Govemment Act 
because this is a national security system. However, the FBI conducts internal 
PlAs on all national security systems to ensure that privacy is adequately 
considered in system development. A series of PlAs have been conducted on 
IDW. Addition PlAs should be conducted as changes are made to the system. 

FY08-035 Centralized Cable Plant 
Infrastructure 

1 N (but see 
status/explana 

N 

This investment funds the ongoing activities necessary to sustain the FBI HQ 
IT Centralized Cable Plant infrastructure. The cable plants are used to 
distribute the FBI's various networks to FBI facilities. As such, these projects 
do not involve the collection, maintenance or dissemination of identifiable 
data. Instead, they provide support for the networks that do transport data; as 
such no P1A/SORN required. 

Note - PlAs/SORNs are required for applications/service/content supported by 
the cable if these otherwise meet the PIA criteria. 

Note - E-300 mentions a cable management system (Visionaei). If this system 
captures identifiable information a PIA may be required. 

Note- E-300 mentions an HQ IT trouble ticket management system- if only 
contains information about government employees, no E-government PIA 
reauired fintemal system) but an FBI PIA is reauired. 



2 

Bureau Personnel 
Management System (BPMS): 

4 PTAs: 

(1) . BPMS-Address Locator Subsystem (ALS) 

(2) BPMS-Applicant Processing Subsystem (APS) 

(3) BPMS-Federal Parent Locator System (FPLS) 

(4) BPMS (composite PTA for remaining BPMS applications: Agency . 
Parking Administration; BPMS Bulletin Board; Employee Self Query; 
Organization Inquiry; Travel Locator; Administrative Time Capture; 
Payroll; Agent Career Board; Agent Transfers; Batch Reporting; 
Counselor Matters; Critical Case Tracking; Drug Deterrence Program; 
Employee Benefits; Equal Employment Opportunity; General Reporting; 
Health Care Programs; Issued Personal Property; Job Postings 
Application for Special Agents: Personnel Ad Hoc Reporting; Office of 
Professional Responsibility; Leave Administration; Pay Administration; 
Performance Recognition; Personal Contact Update; Position 
Classification; SF-52 Requests; Skills; Staffing; Funded Staffing Levels; 
Training; Facility Security System; Random Personnel for Polygraph 
Testing; Five Year Reinvestigations; Security Clearance/Security 
Clearance Reporting; and Undercover Special Operations) 

3 

Campus WAN 

Campus WAN 

mM 

Chemical Network (ChemNet) 

ChemNet 

Efl 

CJIS WAN 


H 


N/A (PIA previously conducted) 

7 

Commercial Payments Unit 
Invoice Management System 
(CPUIMS) 

CPUIMS 

8 

Computer Analysis Response ■ 
Storage Area Network 
(CARTSAN) 

CARTSAN 

El 

CYBERTRANS II 

CYBERTRANS II 

H 

Data Collection System 3000 
(DCS-3000) 

DCS-3000 

HI 

Digital Document . 
Management System (DDMS) 

DDMS 

■a 

Document Capture System 

Document Capture System 

13 

Financial Management System 
(FMS) 

FMS 

14 

Field Office Integrity Security 
System (FOISS) 

FOISS 

15 

Forensic Audio, Video, and 
Image Analysis (FAV1A) . 
LAN ' 

FA VIA LAN 

16 

Innocent Images Case 
Management System (IICMS) 

N/A (PIA previously conducted) 


#1056287-000 
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Freedom of Information 

and 

Privacy Acts 

FOIPA# 1056287 and FOIPA#1056307-1 
Subjects: DCS-3000 and RED HOOK 
File Number: DIVISION DOCUMENTS 
Section: 36 



Federal Bureau of Investigation 




Voicebox Upgrade 


|(OM) (FBI) 

tr 28, 2006 4:39 PM , 

iQTD) (FBI) , 

JOM) (FBI); 


UNCLASSIFIED 

NON-RECORD 


Here are some of the pics from the sysadmin room for our TIII/T50 equipment. Both the V oicebox ne twork an d 
network are administered from that room. Our DCS3000 systems, an FBI net computer, the ! t ransportable 
system, all of our slave controllers and patch panels for our collection lines are contained in this one 9'x12’ room. jj 

On the fi 1 workstation wp havA ths fniinwinn v/nirPhny components (which are all minitowers): 

Server! bne AWS, two cisco routers, four modems, four UPS and two CRT 


wo aion have the following DCS3000 equipment on the same lack— 

1 p pu, DCS3000 criminal cpu, DCS3000 FISAcpu, 4 po d I an FBI net cpu, an HP Printer, 3 UPS, an Edgeport 

serial hub, our data intercept modem and firewalls/hubs, and a number of 3 ring binders. 

Then in the double rack system on the left side as you enter the room we have all our rack mounted slave controller 
equipment, patch panels, latchbox panels, and other JSI legacy equipment. 

I’m of the opinion that if we can wait on the equipment upgrade until we move into our new office it would save 
everyone a lot of work and headaches. If we have to go with the equipment upgrade right now we may want to coordinate 
the DCS3000 equipment upgrade so all we have to worry about findinaajrionitoring station for will be the FBInet cpu, the 
printer, all the non-rack mountable UPS, th e modem s and routers, th a I the monitors (unless we can run 

everything but the FBInet cpu thru one 8 pol then we'd only have two monitors) and the binders. 

Let us know what you think. I think the DCS3000 folks were considering waiting on our upgrade to rackmount until we 
move into the new office. Seems like we'd be doing the same work a second time inside of two years'when we move to 
our new office. 


Federal Bureau of Investigation 
Omaha Division 

10755 Burt St, Omaha, NE 681 14 

402l besk 

402i Fax 

402j IVIain Office 
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KB) K8) KB) KB) KB) KB) KB) 
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DATE: 06-13-2007 

CLASSIFIED BY 6 5179 DMH/TAH/KSR/JB ALL INFORMATION C( 

REASON: 1.4 (g) . J K J HEREIN IS 0NCLASS3 

DECLASSIFY ON: 06-13-2032 SECt^O" TiJHEEE SHOW OTHER! 


ALL INFORMATION C OBTAINED 
HEREIN IS UNCLASSIFIED EXCEPT 
WHERE SHOWN OTHERWISE 


FW: Remote VoiceBox Networking 


I've been asked to look i nto the poss ibility ot extending our Charlotte-based VBill network to an outlying ottsite, about 5 
miles away. I spoke with ! I vhile he was here this week updating our VBII1 system and he said that remote 

workstations could be networked into the rack system at Charlotte. He also mentioned that Chicago was participating 
in a pilot project that accomplishes a similar objective. 

We are only two TTAs here with no plant support so I am trying to get a handle on the complexity of this type of 
project. In general terms, what are the costs in time, money, personnel? How much coordination is involved with 
vendors, ERF, security division, physical facilities unit, local ETs, local security and physical plant personnel? What 
kinds of equipment would be necessary and who would spec the job and provide the gear and installation? From 
Chicago I understand that we would require, at minimum, the remote clients (provided by ERF via JSI), minimum 
128K circuit between main site and remote (is this one circuit per client?), circuit for the DCS3000 (bandwidth 
required?), two routers (main site & client site provided by ERF), and a PIX Firewall (also provided by ERF). These 
are some of the questions I will need to find answers for before I give a response to our management regarding this 
proposal. 

I appreciate any help you can provide. Thanks! 



X 


( 3 ) 



From: ! 

ICG) (CON) 


Monday, September 55 ! 2006 9:35 AM 

To: b?c 

l(CE) (FBI) 

Cc: 

1 DTD) (FBI) 

Subject: 

RE: Remote VoiceBox Networking 


UNCLASSIFIED 

NON-RECORD 


I just got back in the office so I apologize for not getting back with you sooner. As I would love to inform you of our testing 
of the remote VB clients, I unfortunately will be unable to reply in an expeditious manner at this time. I ask that you contact 
jT’™'"’” |ERF) regarding this as he would have better information in most of the areas of question. I can then provide to ' c 
TOll&W-Up Showers or possibly fill-in the blanks. In generic terms, here is what is involved: 

Remote Clients - Provided by ERF through vendor 

Minimum 128K circuit between main site and remote (We have a separate T1 for one of our remote sites and the other we 
are using the T1 for the DCS3000) - Site would have to pickup cost 

(2) Routers - (Main site & Client Site) - Provided by ERF 

PIX Firewall - Provided by ERF 

Time frame to setup once circuit is up is no more than two days (as long as there are no major issues) 

— Original Message — 

From: I If CE) (FBI) 

Sent: Wednesday. September 20, 2006 1:12 PM 

To: I ! (CG) (CON) 

Subject: Remote Voice&ox Networking 

UNCLASSIFIED 
NON-RECORD b6 

b7C 


I've been asked to look i nto the poss ibility of extending our Charlotte-based VBIII network to an outlying offsite, about 5 
miles away. I spoke with l W hile he was here this week updating our VBIII system and he said that remote 

workstations could be networked into the rack system at Charlotte. He also mentioned that Chicago was participating 
in a pilot project that accomplishes a similar objective. 

We are only two TTAs here with no plant support. I am trying to get a handle on the complexity of this type of project. 
I'd like to ask you, in general terms, what are the costs in time, money, personnel? How much coordination is involved 
with vendors, ERF, security division, physical facilities unit, local ETs, local security and physical plant personnel? 
What kinds of equipment would be necessary and who would spec the job and provide the gear and installation? 

These are some of the questions I will need to find answers for before I give a response to our management regarding 
this proposal. 

I appreciate any help you can provide. Thanks! 


FBI Charlotte Division 
(704T^ I 

(704| fax 


b2 

fo6 

b7C 


UNCLASSIFIED 


SE$I%T X 


( 4 ) 





From: 

Sent: 

To: 

Subject: 


b6 


I LA) (FBI) 

Tuesday. September 19. 2006 11:42 AM 
■ □OTD) (FBI) 


RE: Voice Box Question 


UNCLASSIFIED 

NON-RECORD 


Yahoo! We'll watch for it. Thanks again, 


□ 


— Original Message — 

From: I b tm (FBI) 

Sent: Tn^riav WomTw 19 ( 2006 5:39 AM 

To: 1 —I LA) (FBI) 

Subject: RE: Voice Box Question 


UNCLASSIFIED 

NON-RECORD 


Offline Analysis Workstation is being shipped today with inkjet printer. OAW should be returned to ERF at some point 
but please do not return the printer. 


No PointSec installed, it crashed the first system we tried to put it on. 

Win dows and Voice Box user accounts are the same and are as follows: 
Used I 


Please create additional accounts for your user to use. r D6 

b7C 
b7E 


U5 ' SK-7U: 
Cell - 202 \ 


□ 


— Original Message — 

From: | lA) (FBI) 

Sent: mesaay. September 12, 2006 3:10 PM 


Subject: RE: Voice Box Quezon 


UNCLASSIFIED 

NON-RECORD 


bo 

b7C 


OK, thankf" 

Zl 

1 1 



— Original Messinn ■ 

From: I I COTDl (FBI) 

Sent ijesday, September 12, 2006 11:49 AM 

To: l I ftA) (FBI) 

Subject: RE: Voice Box Question 

UNCLASSIFIED 

NON-RECORD 


SE-fr^T 


X 


( 6 ) 





Speaking witl | ~| his morning I believe th< 


I did receive a VoiceBox Review WS recently but we have not been able to get Pointsec loaded on it. We are 
working to acquire a more up to date version of Pointsec to see if will make a difference. Also we are short 
staffed at the moment and have been given numerous other priorities as each day unfolds. I am in NY this 
week and hope to be able to address the issue with Pointsec next week when I return. 


— Original Message — 

From: I l OAHFBn 

Sent: Monday, September 1 1, 2006 7: 28 PM c 

To: I , ..,.Z10TD) (FBI) r 

Cc: I | A) tFBtt “ 

Subject: Voice Box Question 


UNCLASSIFIED 

NON-RECORD 


We currently have a l m il. For some reason the | ICDC input keeps going 

down in Voice Box. Yet, on the DCS3000 network the connection to | Is fine. Why would 

the connection be dropping on Voice Box? Should we call the help line? Or is this a problem 
with which you are familiar? 


PS- Have you received the portable Voice Box review stations yet? The case agent here in LA 
keeps bugging us about this. 


X 


( 7 ) 



From: 

Sent: 

To: 

Subject: 


i bTm (FBI) 

Tuesday. Septem ber 19, 2006 8:39 AM 
I ~ ,, . 1 (LA) (FBI) 

RE: voice Box Question 


UNCLASSIFIED 

NON-RECORD 


Offline Analysis Workstation is being shipped today with inkjet printer. OAW should be returned to ERF at some point but 
please do not return the printer. 


No PointSec installed, it crashed the first system we tried to put it on. 


Wind( 

User . 
Password: I 


‘Box us er accounts are the same and are as follows: 


Please create additional accounts for your user to use. 

Lesk-V6JT ^ 1 

Cell - 202-1 


be 

b7C 


Original Message — 

From: |“ |u) (FBI) 

Sent: Tuesday, September 12, 2006 3:10 PM 

To: I "" |OTD) (FBI) 

Subject: ' Kb Voice box Que stion 

UNCLASSIFIED 

NON-RECORD b6 


OK, thanks 

=1 

1 



foil 

b7C 


— Ori ginal Message — 

From: 1 l OTD) (FBI) 

Sent: _ Tuesday, ^eptemS er 12. 2006 11:49 AM 
To: | | U) (FBI) 

Subject: Kb Voice Box Question 


UNCLASSIFIED 

NON-RECORD b2 

hlE 


Speaking with | I his morning I believe the j ~| 


ssue was resolved. 


I did receive a VoiceBox Review WS recently but we have not been able to get Pointsec loaded on it. We are 
working to acquire a more up to date version of Pointsec to see if will make a difference. Also we are short staffed 
at the moment and have been given numerous other priorities as each day unfolds. I am in NY this week and hope 
to be able to address the issue with Pointsec next week when I return. 


* Desk- 
Ceil - 202- 


SE(MT 


X 


( 8 ) 




— Original Messa2e---_________ 

From: I l AI (FBI) 

Se nt: Mo nday. September 11, 2006 7:28 PM 

To j I (OTO) (FBI) 

Cc | K LA) (FBI) 

Subject: """Voice Box Question 

UNCLASSIFIED 

NON-RECORD 


We currently have d I Till. For some reason th a CPC input keeps going 

down in Voice Box. Yet, on the DCS3000 network the connection to| [is fine. Why would the 

connection be dropping on Voice Box? Should we call the help lineTTJnTFnis a problem with which 
you are familiar? 


PS- Have you received the portable Voice Box review stations yet? The case agent here in LA keeps 
bugging us about this. 


X 


( 9 ) 


St&RET 


From: 

Sent: 

To: 

Subject: 


UNCLASSIFIED 

NON-RECORD 


□(OTP) (FBI) 

I I lahfbii 

Tuesday, Septembe r 12, 2006 3:10 PM 
I I fOTD) (FBI) 

RE: Voice Box Question 


be 

bvc 


OK, thank j 

I 


— -Original Message — 

From: I I f OTP) (FBI) fo2 

Sent: Tuesday, Septemb er 12, 2006 11:49 AM fc6 

To: I ~~i A) (FBI) fo7C 

Subject: RE: Voice Box Question blE 

UNCLASSIFIED 

NON-RECORD 


Speaking witt | ~[ his morning I believe th ^j "j issue was resolved. 

I did receive a VoiceBox Review WS recently but we have not been able to get Pointsec loaded on it. We are working 
to acquire a more up to date version of Pointsec to see if will make a difference. Also we are short staffed at the 
moment and have been given numerous other priorities as each day unfolds. I am in NY this week and hope to be able 
to address the issue with Pointsec next week when I return. 


Desk- 70 ■ 
Cell - 202 


be — Original Message — 

■fc 7 C From: | |(LA) (FBI) 

Sent: MindS 1 /, Wjltember 11, 2006 7:28 PM 

To: | |(OTD) (FBI) 

Ca \ I t LA) (FBI) 

Subject: voice box Question 

UNCLASSIFIED 

NON-RECORD b2 

b7E 

□ i 

We currently have a l V lll. For some reaso n th d fc DC input keeps going down in 

b6 Voice Box. Yet, on the DCS3000 network the connection tc| |is fine. Why would the connection 

fc7c be dropping on Voice Box? Should we call the help line? Or is this a problem with which you are 

familiar? 


I 

PS- Have you received the portable Voice Box review stations yet? The case agent here in LA keeps 
bugging us about this. 


UNCLASSIFIED 


SEl^fT 


X 


( 10 ) 



I |(OTD) (FBI) 

Tuesday, September 12, 2006 2:49 PM 
I I LA) (FBI) 

1 Kb: Vbicfe Box Uuestion 


UNCLASSIFIED 

NON-RECORD 


Speaking with ) "[ this morning I believe the j ~| is 


I did receive a VoiceBox Review WS recently but we have not been able to get Pointsec loaded on it. We are working to 
acquire a more up to date version of Pointsec to see if will make a difference. Also we are short staffed at the moment and 
have been given numerous other priorities as each day unfolds. I am in NY this week and hope to be able to address the 
issue with Pointsec next week when I return. 


— Original Message 

From: l___ 

Sent: Monda 


JLA) (FBI) 

iber 11, 2006 7:28 PM 
j JOTD) (FBI) 

_|A) (FBI) 


UNCLASSIFIED 

NON-RECORD 


We currently have d [III. For some reaso n thd C PC input keeps going down in 

Voice Box. Yet, on the DCS3065 network the connection tcj ps fine. Why would the connection be 

dropping on Voice Box? Should we call the help line? Or is this a problem with which you are familiar? 


PS- Have you received the portable Voice Box review stations yet? The case agent here in LA keeps 
bugging us about this. 


SEGKET 


X 


( 12 ) 




I KLA) (FBI) 

Monday September 1 1 , 2006 7:28 PM 
(OTD) (FBI) 

JLA) (FBI) 

Voice Box Question 


UNCLASSIFIED 

NON-RECORD 


□ 


We currently have a l fr ill. For some reason the| [ CPC input keeps going down in Voice 

Box. Yet, on the DCS3000 network the connection tc j ~~| s tine, wny would the connection be dropping 

on Voice Box? Should we call the help line? Or is this a problem with which you are familiar? 


PS- Have you received the portable Voice Box review stations yet? The case agent here in LA keeps bugging us 
about this. 





SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


All, 

This is to recap the discussion/test that we did on the VB this morning. First, the problem statement: k 2 

b7E 

Incoming calls where both target and associate are within the same switch for | ~| may only 

populate the CALEA Temination Attempt message “Calling Party" identification neia witn ine 
MIN (Mobile Identification Number). The MIN is not guarnteed to be the calling party's phone number 
(it is a valid 10 digit number) and is being populated in the VB as the CALLING PARTY'S phone number. 

Through I b nalvsis. it is seen that the subsequent “Network Signal" message has within it a "CALLING 
PARTY" field with the caller id of the calling party. This has come up in several cases and specifically I have 
had several conversations with the Chicago FO about the affect this has on their Title Ill's and requests for 
potential pens off this FALSE information. 


The DCS 3000 currently looks for 
addressed with JSI for the VB and 


the "Calling Party " id in the C 
I j for the | | 


ailing DN field only. This problem should be 


□ 


SENSITIVE BUT UNCLASSIFIED 



X 


( 14 ) 


I IO TP) (FBI) 

Thnrcrla'/ -Ini'/ Aft Tflnfi fl Uj AM 
I \(CG) (FBI) 

RE: Chicago remote VB 


UNCLASSIFIED 

NON-RECORD 


Some additional equipment from JSI was already shipped and received at Chicago for this install, it needs to be added to 
the property database for your site. 

We will be sending out a couple of routers and a switch to Chicago this week. Also an additional PIX fof |may 

ship early next week. 1 1 

I will temporarily send our multi CD player and patch panel next week for testing purposes. 

Let me know on Monday when the T1 line is confirmed. I plan to travel out on Tuesday if all goes well. 


— Original Messag 

From: I 

Sent: Mond 


jj (CG) (FBI) 
iv. July 03. 20 06 4:36 PM 
I OTP) (FBI) 
iicago remote VB 


UNCLASSIFIED 

NON-RECORD 


| | The T-1 will be ready on Monday. 

[=□ 


bTD) (FBI) 

1006 6:4 8 AM 

|C6) (FBI) 


UNCLASSIFIED 

N O N - RECO R D 


How well is the T 1 installation going for th j p This looks to be the largest unknown at the time the whole 

schedule will be dependent upon it be com fitted. 

I also ordered 5 additional AWS workstations, 1 additional printer and 1 remote host machine that can be used at 
the sites. They should be arriving at the Chicago office before the July 1 0 date we are working with. 

More scheduling information to follow. 


Desk- 70 
Cell - 202 


SE^ET X 


( 15 ) 




Subject: RE: 


UNCLASSIFIED 

NON-RECORD 


I l l received word today that the WRA has a T-1 available for a T-lll that could be coming as soon as July. 
Chicago can supply workstations for the test and leave a couple out there for the T-lll. How long does the 
testing take? We also have a T-1 out to RRA if you want to do some testing out there. 



UNCLASSIFIED 

NON-RECORD 


j" (i ere is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move 
^qnrrcrylor completion by the date we discussed earlier. 


Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 
Desired location is | |w ith j ~|is a second possible location. 


Circuits would need to be operational before this time. Chicago may work with our DCS30G0 (ab in fe 
acquiring circuits if desired. < 

I believe that you inf prmed me that p hicaao does not have a circuit to thq pt this time but may 

still have one for thq T 1 1 

1 was also informed tnai umcago would pay for the circuit to each location. The desired circuit for each 
would be a full T 1 . 

You had mentioned that the circuits would be temporary and only for the operation of the specified case 
that the office will work. With the remote setup the circuit would need to remain up as long as case review 
was needed at the RA or the case could be processed at the Chicago FO once monitoring was over and a 
circuit discontinued. 


Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository 
machine with CDR capability and a printer. 


Looking forward to your response. 



UNCLASSIFIED 

SECRET X 


( 16 ) 


From: I I CG) (FBI) 

Sent: ihfi Monday, July 03, 2006 4:36 PM 

To: b?C I |(OTD) (FBI) 

Subject: 1 kc. uuuuyis mmuiJ vb 


UNCLASSIFIED 

NON-RECORD 


Q he T-1 will be ready on Monday. 

Original Message — 

From: I t OTDj (FBI) 

Sent: ^ Tuesday . Line 20. 2006 

Subject: RE: Chicago remote VB 

UNCLASSIFIED 

NON-RECORD b6 

fo7C 

CZ3 

How well is the T 1 installation going for the l This looks to be the largest unknown at the time the whole 

schedule will be dependent upon it be completed. 

I also ordered 5 additional AWS workstations, 1 additional printer and 1 remote host machine that can be used at the 
sites. They should be arriving at the Chicago office before the July 10 date we are working with. 

More scheduling information to follow. 

foo 
b7C 




UNCLASSIFIED 

NON-RECORD 


[• I received word today that the WRA has a T-1 available for a T-lll that could be coming as soon as July. 

Chicago can supply workstations for the test and leave a couple out there for the T-lll. How long does the testing 
take? We also have a T-1 out to RRA if you want to do some testing out there. 



Subject: 


\ 

UNCLASSIFIED 

NON-RECORD 



m 


fee 


fe7C 


| here is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move 

quickly for completion by the date we discussed earlier 

Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 

Desired location i ^ j wtth l | as a second possible location. 

Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring 
circuits if desired. 

l believe that vo u informed me t hat Chicago does not have a circuit to thel lat this time but may still 

have one for th j I 1 1 

I was aiso informed that Chicago woufd pay for the circuit to each location. The desired circuit for each would 
be a full T1. 

You had mentioned that the circuits would be temporary and only for the operation of the specified case that 
the office will work. With the remote setup the circuit would need to remain up as long as case review was 
needed at the RA or the case could be processed at the Chicago FO once monitoring was over and a circuit 
discontinued. 


Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository 
with CDR capability and a printer. 

Looking forward to your response. 


Desk- 703 
Cell -202] 


fee 

fe7C 


UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 


UNCLASSIFIED 


SESRET 


x 


( 19 ) 


b2 

b7E 




Subject: FW: OIG Audit of Information Technology Research, Plans, Studies and Evaluations 


UNCLASSIFIED 

NON-RECORD 


All - Attached in the message below is the OIG's "final" list of documents they have not received concerning the DCS- 
3000, DCS-5000, and DCS-6000. Please review your records and forward to me any documents you find, I will forward 
them to the OIG. 

jlhanto. ^ 

be 

— Original Message — 

From: | I NSD) (FBI) 

Sent: Friday, June 30, 2006 10:38 AM 

To: I l(OTD) (CONI 

Cc: I I lNSD) (FBI) 

Subject: oig Audit or information Technology Research, Plans, Studies and Evaluations 

UNCLASSIFIED 

NON-RECORD 


Hello: 

I just received an e-mail from the OIG regarding documents that were not received pertaining to Digital Collection. I know 
you are in the process of giving me additional documents. I am attaching the list of items, so that you could compare your 
list with the OIG. I will continue to collect the documents from the S: drive. 



DIGITAL 

LECTION.pdf (936 C 


Thank you, 



UNCLASSIFIED 

UNCLASSIFIED 




From: 

Sent: 

To: 

Subject: 


I ^ OTD) (FBI) 

, Thursday. June 22. 3QQ6 2:59m 

I , — JS) (CONL 

Boston upgrade notes 


](BS) (CON) 


UNCLASSIFIED 
NON-RECORD 

b6 
b'rc 

Please ship toolbox back to ERF to TICTU £ 

A I l and cables should be shipped from ERF tc) to connect the both DCS3000 machine and the one way 

push 10 side machine to the keyboard/monitor device ]b 

JSI has an open ticket for the bad AWS 13 machine, they should be sending a replacement power supply 

One of th d I s bad, JSI wil l need to be calle d and start a trouble ticket on it to be repaired, most likely it will need 

to be sent to JSI in Sterling, VA. 86 ^ | 

I emailed instructions on how to setup VirusScan on the AWS machines, I was only able to do AWS1, the rest still need to 
be done 

I told l I that I called JSI and I am having them replace the screens for the AWS machines, you should be getting 14 
new flat panel screens for the 14 AWS machines, they may come with built in speakers but don't use them, 1 here that the 
speaker portion works poorly. T ry not to lose the new screens on other machines. f 

I also am having JSI send a replacement for CDR2, the replacement will also record to DVD. Once the new system is in Ib 7C 
then the old CDR2 should be excessed, no more support will be available for it from ERF. 


5 got the new wiring in but the VB UPSs were tripping the breaker, he said that he would correct the problem with the 
ers when he returns from vacation. Extension cords for the time beingl 


I spoke with| |at JSI about trying to see if the Providence upgrade to 3.6 could be done soon, please follow up with 

JSI to see if it will be possible. 86 a l 

I will be out next week until Thursday. 


Youi j p rogram will need to be loaded on the new VBSVR machine to remote control Providence 

The old VoiceBox servers may be excessed or redestributed. ERF will no longer support any of these devices. 
You may need the front covers for the Providence system 


be 


Desk- 70 J" 
Cell - 202-1 


UNCLASSIFIED 


S^RET 


( 21 ) 



From: I I CG) (FBI) 

Sent: Thursday. June 22, 2006 5:25 PM 

To: | [OTD) (FBI) 

Subject: 1 kb: Chicago remote 1 VB 


to 6 

UNCLASSIFIED b7C 
NONiRECORD 


I The T-1 was ordered but I don't have a due date yet. I'll keep you up to date as the info comes in. 

£_] 

— Original Message — 

From: | |(OTD) (FBI) 

Sent: Tuesday, June 20. 2006 4:4 8 AM 

To: l r nm (FBI) 

Subject: RE: Chicago remote VB 

UNCLASSIFIED 

NON-RECORD 


^ .. - .i —— .— b2 

How well is the T1 installation going for th q f This looks to be the largest unknown at the time the whole fo7E 

schedule will be dependent upon it be completed. 

I also ordered 5 additional AWS workstations, 1 additional printer and 1 remote host machine that can be used at the 
sites. They should be arriving at the Chicago office before the July 10 date we are working with. 

More scheduling information to follow. 



UNCLASSIFIED 

NON-RECORD 


□ I received word today that the WRA has a T-1 available for a T-lll that could be coming as soon as July. 
Chicago can supply workstations for the test and leave a couple out there for the T-lll. How long does the testing 
take? We also have a T-1 out to RRA if you want to do some testing out there. 





UNCLASSIFIED 

NON-RECORD 


I h ere is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move 
quickly for completion by the date we discussed earlier. 

Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 


Desired location is | | with | fe s a second possible location. 

fa 

Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring fc 

circuits if desired. 

l believe that vn u informed ms fo nt Chicago does not have a circuit to the I a t this time but may still 

have one for th d I 

I was also informed that Chicago would pay for the circuit to each location. The desired circuit for each would 
be a full T1. 

You had mentioned that the circuits would be temporary and only for the operation of the specified case that 
the office will work. With the remote setup the circuit would need to remain up as long as case review was 
needed at the RA or the case could be processed at the Chicago FO once monitoring was over and a circuit 
discontinued. 

Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine 
with CDR capability and a printer. 

Looking forward to .your response. 


SE^r X 


( 23 ) 


From: 

Sent: 

To: 

Subject: 


I l oTD) (FBI) 

Tuesday, June 30 , 2QQg 7:48 AM 
I I CG) (FBI) 

Kt: Chicago remote va 


UNCLASSIFIED 

NON-RECORD 



How well is the T1 installation going for 
will be dependent upon it be completed. 


th([ 


} 


This looks to be the largest unknown at the time the whole schedule 


I also ordered 5 additional AWS workstations, 1 additional printer and 1 remote host machine that can be used at the sites. 
They should be arriving at the Chicago office before the July 10 date we are working with. 


More scheduling information to follow. 


Desk- 70f 
Cell - 202L 


fo6 

b7C 


— Original Message 

From: I t G) (FBI) 

Sent: Tuesday. June 06, 2006 12:38£M . 

To: I tO TD) (FBI)I _J (CG) (CON], 

cc: I , □a jgqg t ^ C0N C 

Subject: Rti 1 

UNCLASSIFIED 

NON-RECORD 


JOTD) (FBl£ 


JOTD) (FBI); 


a - 1 received word today that the WRA has a T-1 available for a T-lll that could be coming as soon as July, 
go can supply workstations for the test and leave a couple out there for the T-lll. How long does the testing 
take? We also have a T-1 out to RRA if you want to do some testing out there. 


□□ 


foe 

fo7C 


-—Orig inal Message — 

From: I k OTDI (FBI) 

sent: Turerlav May 30. 7006 q:p B AM 

To: I I rrGWFBTM , Ikisl 

Cc: | (0IE>) (FBI) l I tD) (CONlQ 

UNCLASSIFIED 

NON-RECORD 


]oTD) (FBI £ 


] (OTD) (FBI) 


f t iere is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move quickly 
for completion by the date we discussed earlier. 

Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 


i d I wit fl fe s a second possible location. 

X (24) 


Desired location i‘ 


Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring 
circuits if desred. ■ ■ Ib 2 

I believe t hat vou informed me that Chicago does not have a circuit to thej |t this time but may still have ic.7 s 

one for th l I 

I was also informed that Chicago would pay for the circuit to each location, The desired circuit for each would be a 
full T1. 

You had mentioned that the circuits would be temporary and only for the operation of the specified case that the 
office will work. With the remote setup the circuit would need to remain up as long as case review was needed at 
the RA or the case could be processed at the Chicago FO once monitoring was over and a circuit discontinued. 


Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine 
with CDR capability and a printer. 


Looking forward to your response. 



UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 


SB8SET 


( 25 ) 


From: 

Sent: 

To: 


(OTD) (FBI); 


Cc: 

Subject: 


I I fOTD) (FBI) 

Monday, June 19. 2006 11:38 AM 
f IfOTDUFBnl 

l uiDHCONI 

I I fOTD) (CONI 


FW: ITAB Briefing Schedule (& Template) 


UNCLASSIFIED fog 

NON-RECORD fc7C 


Gents, r *i 

I want to provide you with a "heads-up" as to a presentatio n W ill most likely be putting together this Fall. It 
is high level and | t will be needing some assistance to complete. Thanks. 


□ 

— Original Mess age — 

From: I ~~l oTD)(CQN) fee 

Sent: Monday. June 19. 2006 10:23 AM fe7c 

To: I JOT D) (FBI) 

Cc: I—— I OTP) (CON) 

Subject: FW: ITAB Briefing Schedule (& Template) 

UNCLASSIFIED 

NON-RECORD 


m i 

Here is the ITAB template. Whe l [g ets in tomorrow, I will see what Powerpoint presentations she has on the DCS- 
3000, DCS-5000 & DCS-6000 and try to incorporate as much as I can. 


I TliankS| 


Original Message;;;;;^ 

From: I 

Sent: Monday 


RE: ITAB Briefing Schedule 


UNCLASSIFIED 

NON-RECORD 


fee 

fe7C 


Hi l I 

Thanks for your inquiry. 

Yes, the briefing is high-level. The ITAB members are all Assistant Directors - from all FBIHQ 
divisions. 

Attached is the template that the CIO established as the standard for all ITAB briefings. Use this as 
your guide and it is specific about the kind of information requested. 

SEJ^T ^ (26) 


S^T 


If you need any further guidance/ assistance, please contact me. 


Thanks again. 


WckbJ g: 20 ^ | b6 

ITAB 

)late-May06.ppt (1 f 

--original Message:— . ■ . 

From: I l OTDKCONl 

Sent: Friday. June 16, 2006 11:2 0 AM 

To: I fOCIO) (CON) 

subject 1 TarmBw a w g ^aafe 
Importance: High 

UNCLASSIFIED 

NON-RECORD 


Hell O 

I have been tasked with putting together this presentation for TICTU/DCs l \ In your initial remail, you 

mentioned that you would be sending out a template for these presentations^ If you have one, would you please 
forward it along to me? I know if you do have a template-that will be a good starting point for me to start working from. 


I l also wanted me to ask the type of information you are looking for us to present? I see from your initial email 
you want the presentation length to be around 20 minutes so it looks like you want to keep things at a high level. 


that 


Please advise. 


Thank you. 


703|_ 


b6 

b7$S 


— Origin al Message- — 


From: f 

|(OTD) (CON) 

Sent: HTO, JUHS lb, 2U 


To: | 

|(OTD)(CON) 

Subject: FW: ttAB Briefing ‘ 

chedule 

Importance: High 

b6 

UNCLASSIFIED 

NON-RECORD 

b7C 


□ here is the information ! ~1 wanted me to pass on to you. 


QT D/ESTS/TICTU 
703 1 1 


Original Message — 


Subject: 1 FWillABUrittrig 
Importance: High 


(OTD) (FBI) 

, 2006 4:59 PM 
JOTD) (CON) 
J(OTD) (FBI) 
fedule 


SEJ 


;eJ*£t 


b6 

b7f|' 


( 27 ) 


X 


ICG) (< 


l(CG) (FBI) 

06, 20 06 12:38 PM 

| O TP) t FRIM 
nOTPWFBlil 


UNCLASSIFIED 

NON-RECORD 

□ I received word today that the WRA has a T-1 available for a T-lll that could be coming as soon as July. Chicago 
can supply workstations for the test and leave a couple out there for the T-lll. How long does the testing take? We also 
have a T-1 out to RRA if you want to do some testing out there. 


UNCLASSIFIED 

NON-RECORD 


f h ere is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move quickly for 
completion by the date we discussed earlier. 

Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. fo2 

Desired location is j ~| vith | | as a second possible location. 

Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring circuits if 
desired. ______ 

I beli eve that vou info rmed me that Chicago does not have a circuit to th d I t this time but may still have one 

for th d I 

I was also informed that Chicago would pay for the circuit to each location. The desired circuit for each would be a full 
T1. 

You had mentioned that the circuits would be temporary and only for the operation of the specified case that the office 
will work. With the remote setup the circuit would need to remain up as long as case review was needed at the RA or 
the case could be processed at the Chicago FO once monitoring was over and a circuit discontinued. 

Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine with 
CDR capability and a printer. 

Looking forward to your response. 


SEj 


!ET 


X 


From: 

Sent: 

To: be 

Cc: b7C 


1 llOTDI IFBh 

Tuesday. Mav30. 200610:08 AM ^ 

1 | na) fFRIVl 


1 IftTHl) (FRhl 

JITD) (CON)| I 


J(OTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


I h ere is what I have so far for Chicago to be a test site for remote VoiceBox, we will need to move quickly for 
completion by the date we discussed earlier. 


Discussed installation date of VoiceBox equipment and initial test. Begin on Monday July 10th. 


Desired location i .4 _jyith | fe s a second possible location. 

Circuits would need to be operational before this time. Chicago may work with our DCS3000 lab in acquiring circuits if 
desired. . 

I that win infnrmpri me that Chicago does not have a circuit to th | p t this time but may still have one for 

I was also informed that Chicago would pay for the circuit to each location. The desired circuit for each would be a full T1 . 
You had mentioned that the circuits would be temporary and only for the operation of the specified case that the office will 
work. With the remote setup the circuit would need to remain up as long as case review was needed at the RA or the case 
could be processed at the Chicago FO once monitoring was over and a circuit discontinued. 


b2 

b7E 


Will Chicago be able to supply the AWS workstations from the FO to the remote sites for this test? 

I believe we had mentioned 4 AWSs for the remote site. ERF would also add a remote site repository machine with CDR 
capability and a printer. 


Looking forward to your response. 


Desk- 7031^ 
Cell -202-|. 


be 

b7C 


UNCL ASSIFI ED., 



( 32 ) 


X 



UNCLASSIFIED b7C 
NON-RECORD 


This can be done if needed. You will need to submit one RMS for a system and one also for the DCS3000 group if they do 
not currently have that ability. 



UNCLASSIFIED 

NON-RECORD 


H I 

Thanks for all the equipment. 

Plantation is going up on their wire this week and everything is working perfectly. 

Now the big question, West Palm Beach wants tn nn nn nn a wire around June. Can Miami get another portable 
VoiceBox system? I told them no, but SS/>| Ranted me to ask you formally. 



NON-RECORD 






From: | I (MM) (FBI) 

Sent: Friday. May (H. ?006 in:.iq AM 

To: I l l'MM'i (FBI) 

Cc: I I MM) (FBI) 

Subject: VOICEBOX FOR Till @ PBCRA 

UNCLASSIFIED 

NON-RECORP 


I I I am the case agent re. I I We 

have drafted a Till Affidavit and expect to go up in June 06'. lspoketo | | re: a voicebox for the PBCRA so 
that we can monitor at West Palm Beach. He said we needed to send VUU a iLrmal request I understand that we 
may have to borrow a voicebox from Quantico. Anything you can do will be appreciated. Thanks! 


X 



UNCLASSIFIED 

NON-RECORD 


FYI! 

This bulletin was brought to our attention yesterday. We didn't know if you guys had seen this back in the lab, so we jb 
thought we would send it your way. This bulletin refers to counterfeit parts within the routers. 

We have the same 2600 series l I nstalled for our DCS3000 unit. We have not verified the part 

numbers yet, because it will require us to remove the router from the rack and possible power it down to look inside. Do 
you have any guidance on checking inside the router without taking it down? 

b6 
b'7C 




FIN-06-118-01.pdf 
(696 KB) 


UNCLASSIFIED 


S^fET 


( 35 ) 


X 


UNCLASSIFIED 

NON-RECORD 


I I OTP) (FBI) 

Thursday, May 04, 2006 10:45 AM . 

I b TD) (FBI); [ 

OTP) (CON) *; 

I lOTDI fFBIir 

fCGWFBIVI 

r M 11 | 0 TDHFBn[^ 

Chicago DCS IP plan 


There has been a slight change to the IP address plan for the Chicago move. We have temporarily allocated a new block 
of IPs to the old building and a new block to the new building. Here is the list of events that need to happen: 


(2) 1. Add new block of IPs to old building - 

this has already been done with the main router set fori 


use this as the gw) 


2.a. Change th e IPs fo r the portable VB at the old building to use the 7th RA scheme, 
b. Change thel bne way push boxes at the old building to use the 7th RA scheme. 

( 3 ) -3: lnstatt new circuit to new building with +p adHresspR nfj 

router will be installed with ip address fuse this as the gw) 

4.a VB at new building should be setup to use IPs for 8th RA scheme 
b | fr ne way push boxes at new building should be setup for 8th RA scheme 


6. a. Change.i£BJPs at new building to main FO IP scheme, 
b. Change | p ne way push IPs to main FO IP scheme. 

*** note, the aoove step is optional, but recommended *** 

7, When service at old building no longer needed, shut down circuit. 


Going with this plan will make the transition much more simple. The drawbacks are having to change the VB anil I 

addresses after the systems are up and running, or, if we skip step 6, then the waste of a block of IPs. 1 I 


If anyone has any questions about this, please give me a call. 


X 


( 36 ) 


From: 

Sent: 

To: 

Cc: 

Subject: 


](OM) (FBI) 


106 6:43 PM _ 
JjOTD) (FBI)|_ 

JOM) (FBC 


~tlTD ) (CON) 


v -■/. - i— jOM) (FBI) 

No reply to pings of Denver, Houston, Phoeni) | ^ witches ^ 

b7E 


UNCLASSIFIED 

NON-RECORD 


After adding nev j I S witch inputs to our | 
respons e we got was from the already ex isting StLoui: 
website | [ they were 



iervice Provider in the DCS6000 and trying to ping them the only 
V iput. I used the IP addresses taken from the DCS3000 
follows: 


All ping replies timed out except St Louis. Do we need to add anything to our DCS3000 PIX Firewall routing table to be 
able to get out to these sites? Do you have any idea what we might be doing wrong here? 


Federal bureau of Investigation 
Omaha Division 

10755 Burt St., Omaha, NE68114 


402- 

402- 

402- 


Oesk 

Fax 

Main Office 


lb 2 
fc6 
fo7C 


UNCLASSIFIED 


SE^T 

1 

1 


X 


( 37 ) 


I KOTD) (FBI) 

Thnrortqw Anrii 07 Onflft 7-nQ AM 

I l(SecD) (CON) 

RE: DCS-6000 Accreditation Diagram 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


We have one of our small DCS-6000 available for demo at the OTD Tech EXPO today until 3PM. We are down in the Flag 
Room here at HQ, Come down and bring others from your group to check us out. 


— Original Message- 

From: [ 

Sent: Wgrlno« 


I Seem (CON) 

mtoHnocHaw Ar,ril 8:51 A M 

fc erDVC qNlJ^ 
K ecD)(CON l 
DCS-6000 Accreditation Diagram 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Attached is a network diagram I did based on th 
accurate. I need to get the Tier EC done. Also, 
6000. I want to ensure the POC's in the EC are 


rent documentation. Please take a look and let me know if it is 
ban you update the Registration forms for DCS-3000 and DCS- 


Regards, « File: DCS-6000 Accreditation Boundary Diagram.vsd > 
Diagram.doc » 


< File: DCS-6000 Accreditation Boundary 


SecD/IAS/AU 

( 202 )[ 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


X 


( 38 ) 


___|{SecD) (CON) 

L2006 8:51 AM , 

□(SecD)(CON),| 


I I SecDMCONM 

DCS-6000 Accreditation Diagram 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Attached is a network diagram I did based on t he curr ent documentation. Please take a look and let me know if it is j. 
accurate. I need to get the Tier EC done. Also ! t an you update the Registration forms for DCS- 3000 and DCS-6000. 

I want to ensure the POC's in the EC are correct. 


SENSITIVE BUT UNCLASSIFIED 


X 


( 39 ) 


sSsREt 


CcC 


(FBn£l 




□ (Dl) (CON) 


□ (DL)(FBI)[ 


Security Issues w/ ERF/TTA Networks 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


J)L)(FBI)J 


Jdl) 


Hello y'all - I'm seeking your advice to hopefully save a lot of work} |sn ET in Dallas, just b 

returned from Security training and has been designated the computer/network security person for our 
Division (ISSO?). He advised that HQ has mandated that he obtain all sorts of info from our 
systems/networks i.e: DCS 1000, DCS 3000, DCS 5000, DCS 6000 etc. 

I I wants an accounting for all of the systems we, as TTAs & DCSPs, maintain. He wants to have 
diagrams, schematics, charts etc on what we have and how everything is connected. He wants lists of all of 
the general users and all of the limited/admin users. 

lb 6 

7C Is this duplicating what has already been done @ ERF w / the security certification for each system? Or is 

there a new mandate to have this info on file w / the specifics for each individual field office? 

1 |also discussed restrictions regarding contractors and non employees working on, touching our 
systems. He even mentioned the phone company installers when they come to install/troubieshoot circuits 
etc. My understanding from this conversation is that they are not suppose to bring in computers, test 
equipment, etc that have memory etc. We are suppose to supply the computers/equipment for them to use. 

I know that when JSI comes to install our new VoiceB ox. the week after next, that they will have their own 
computers, fla sh drives etc. I know that whei j | was just here to up grade our database they brought 

fo6 in laptops. SB d I nstallers bring in test equipment & laptops f~ k ill have equipment to test the new 

lb "/ c DCS 3000 network connection in the new Frisco RA in the next couple of weeks. 

How can we best handle this situation? Do I need to get a copies of the certification documents from ERF 
to give to | t ?r should we just walk him through our system and have him make di agrams. Is the re ^ 
something in writing that I can read to better understand what I have to do when, SBCj |JSI, 

I l etc come into our space? ' 

Any advice, comments etc would be helpful. 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SEfe^ET 


X 


( 42 ) 


From: 

Sent: 

To: 

Subject: 


UNCLASSIFIED 

NON-RECORD 


Also| left m e a message that someone in our meeting with them was expecting an updated system drawing. 
Can you call | fc bout this? 

fc6 
fc'7C 



I r OTD) (FBI) 

Monday, April 24. 2006 1 1 :57 AM 
I I (OTD)(CON) 

FW: DCS 6000 Meeting Kickoff meeting attendance sheet for 19 April 2006 


Monday. April 24. 2 006 11:51 AM 

top ) (FBI) r— 

^f SecD)(CON) l K SecD) (FBI);| 

| (OTD) (FBI) 1 — 

DCS 6000 Meeting Kickoff meeting attendance sheet for 19 April 2006 


UNCLASSIFIED 

NON-RECORD 


| p lease pass t£ 


DCS 6000 Meeting 19th April 2006 







SecD/IAS/CU (Certification Unit) 



UNCLASSIFIED 




DCS 3000 Meeting 19th April 2006 






V 


From: 

Sent: 

To: 


foe 

fo7C 


Subject: 


n<OTP> (F B| > 




□ (DL) (FBI) 


Mgn^Y, April 24, 2006 9:43 AM 


E 


(UIU)jFBir 


9:43 AM 
iDLXPBlt 


}OTD)(FB!);|^ 


TOIFBIf 




RE: Security Issues w/ ERF/T TA Networks 


~l inmi rp Riv I 

t QTD) (FBI)) 

1dL)(FBI); | 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Jjave some guidence for the dcs6000, Thanks | 

since ERF is going to get these requests from everyone in me field, I suggest we wait for a unified reply from the ERF folks 
on the dcsl 000,3000 and 5000 platforms at which time we can show how Dallas has configured the interconnections, etc. 
Any ideas? 


— Original Message^^_ 
From: | 

Sent: Sunday, April 


fo7C 


mu 


3DLXFBI) 

Go3:50 PM _ 

"ImTmfFfflli l(OTD) (FBI)l” 

lOTDI (CONI 




Subject: Security Issues w/ ERF/TTA Networks 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


mmm 1 


□(DL)(FBI);Q 


U(OTD) (FBI)J^ 
3DL)(FBI);Q 


□(OTO) 

](DL) 


Hello y'all - I'm seeking your advice to hopefully s 


J an ET in Dallas, just returned 


from Security training and has been designated the computer/network security person for our Division (ISSO?). He 
advised that HQ has mandated that he obtain all sorts of info from our systems/networks i.e: DCS 1000, DCS 3000, 
DCS 5000, DCS 6000 etc. 

I Iw ants an accounting for all of the systems we, as TTAs & DCSPs, maintain. He wants to have diagrams, 
schematics, charts etc on what we have and how everything is connected. He wants lists of all of the general users 
and all of the limited/admin users. 

Is this duplicating what has already been done @ ERF w/ the security certification for each system? Or is there a 
new mandate to have this info on file w/ the specifics for each individual field office? 


Jalso discussed restrictions regarding contractors and non employees working on, touching our systems. 

He even mentioned the phone company installers when they come to install/troubleshoot circuits etc. My 
understanding from this conversation is that they are not suppose to bring in computers, test equipment, etc that have 
memory etc. We are suppose to supply the computers/equipment for them to use. be 


I know that when JSI comes to install ou r new VoiceB ox. the week after next, that they will have their own 


■fo7C 


laptops. 

network 


comput ers, flash driv es etc. I know that whe l i was iu st here to upgrade our database they brought ir 

| 1 installers bring in test equipment & laptops ! Iw ill have equipment to test the new DC 

connection in the new Frisco RA in the next couple of weeks. 

How c an we best handle this situation? Do I need to get a copies of the certification documents from ERF to give 

*■“ “ 1 1 diagra ms. Is there something in writir- 

^ JSI, | j stc come into our 


to | V should we just walk him through our system an d have him make d iagra ms. Is there something in writing 
that I cdn read to better understand what 1 have to do whenj^ ‘~ 1 1 ' 


Any advice, comments etc would be helpful. 


Sf^ET 


( 46 ) 


X 


From: 

Sent: 


Cc: 

Subject: 


U(DL) (FBI) 


Monday April ?4. 2Q 0R 9:40 AM , 
I r OTD) (FBI); [ 


I . hi 

(DLKFBI 1 

RE: Security Issues w/ Ek(-y 1 I A 


□(DL)(FBI);C 

~lrm ^ Bl)r 


jDL)?FBir 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Given that JSI is coming here next week and since they made the systems (and we have absolutely no test equipment or 
knowledge of what the system settings should be) there is no rational alternative to t hem bringing their own stuff wi th them 
and to have complete access to the system. They of course will be escorted by CMPj Jduring 

their vi sit. ^ i i ^ v , 

Thanks l I for suppling the dcs6000 ssp overview. I "l ean get wit 1 -* ***■ '~ MD "* b 

mgr to get the list of Priv. users. I don't see the need for reinventing anyof this, i: 
present at the end of the JSI visit when we go over all the system changes, linkers 
I would suggest the time for that is at the end of the JSI install when we are repopulating the user lists. 

Any ideas? 


— Original Message — 


□OTD) (FBI) 
LJQQL.7-.25 AM 

I PUffBn 


tmu l 

Subject: RE: Security Issues w) WT 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


F7TTK Netwc 


](DL)(FBI)C 


x 


I [ wants an accounting for all of the systems we, as TTAs & DCSPs, maintain. He wants to have diagrams, 
schematics, charts etc on what we have and how everything is connected. He wants lists of all of the general 
users and all of the limited/admin users. 

Attached is the current SSP for the DCS6000 which should take care of the system diagrams and connections with 
much other information. The DCS6000 was accredited 3 years ago and is in the re-a ccreditat ion phase now, once this 
is completed we should have a new set of documents available in the summer or fall ) j should have a list of all of 

the privilege users and general users as well as the signed user forms from all of these user" 

| fr lso discussed restrictions regarding contractors and non employees working on, touching our systems. 

He even mentioned the phone company installers when they come to install/troubleshoot circuits etc. My 
understanding from this conversation is that they are not suppose to bring in computers, test equipment, etc that 
have memory etc. We are suppose to supply the computers/equipment for them to use. 

The contractor equipment issue is technically correct but has been loosely enforced in the past. There is an EC that 
has been uploaded for the JSI foreign nationals to have access to the DCS6000 systems for installation and support 
and the SSP states that JSI personnel will need access to the system for support but must be escorted. 

« File: DCS6000_SSP_012506.doc » 

Overall the Bureau is working on trying to get all of its systems to be security accredited. But with the effort so far there 
are flaws. The documents that govern this process assumes that one standard fits all issues and also most personnel 
that are pulled into this effort and working towards the goals of compliance are learning as they go including the ones 
at the top. 

a S6000 system is classified at Sensitive But Unclassified (SBU). 

i/ill need to check with the Chief Security Officer for your division to find out if JSI can bring there devices and 
lat they need in and out for the installs before they come so JSI can be advised if they cannot. 
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From: I 
Sent: 


Z})L)(FBI) 
354:50 PM _ 
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To: ’ L 

fFBIl l """ ' b ofCQNI 

Subject: Security Issues w/ ERF/TTA Networks 


~tOTD)(CON)' 


]0TD) (FBI)^ 
□DL)(FBI)[ 


SENSITIVE BUT UNCLASSIFIED 
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b6 
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I an ET in Dallas, just ^ 

returned from Security training and has been designated the computer/network security person for our Division 
(ISSO?). He advised that HQ has mandated that he obtain all sorts of info from our systems/networks i.e: DCS 
1000, DCS 3000, DCS 5000, DCS 6000 etc. 


I I wants an accounting for ail of the systems we, as TTAs & DCSPs, maintain. He wants to have 
diagrams, schematics, charts etc on what we have and how everything is connected. He wants lists of all of the 
general users and all of the limited/admin users. 


Is this duplicating what has already been done @ ERF w/ the security certification for each system? Or is 
there a new mandate to have this info on file w/ the specifics for each individual field office? 


{ also discussed restrictions regarding contractors and non employees working on, touching our 
systems. He even mentioned the phone company installers when they come to install/troubleshoot circuits etc. 
My understanding from this conversation is that they are not suppose to bring in computers, test equipment, etc 
that have memory etc. We are suppose to supply the computers/equipment for them to use. 


I know that when | p omes to install pur new Vo iceBox. the week after next, that they will have their own 
comput ers, flash driv es etc. i Know that when ! was jus t here to upgrade our database they brought in 

laptops ! l installers bring in test equipment & laptops. I I wiil have equipment to test the new DCS 

3000 network connection in the new Frisco RA in the next couple of weeks. 


How can we best handle this situation? Do I need to get a copies of the certification documents from ERF 
to give t d l or should we just walk him through our system and have him make diagrams. Is there so methind 
in writing that l can read to better understand what I have to do when l | tc come 

into our space? 

Any advice, comments etc would be helpful. 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 
SENSITIVE BUT UNCLASSIFIED 
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! bLKFBn 

SundaT^orir^TTTifWJjfin PM 


To: 

| , l(OTD) (FBI)J 

POTDWFBIll ( 1 

Cc: 


|DL)(FBI)J | 

Subject: 

| |ULj(FHI);| 

^Security lssu£5 VJI hKW 1 1 A NfilWfirks 

|(DL) (CON) 


SENSITIVE BUT UNCLASSIFIED ib6 

NON-RECORD fo7c 


Hello y'all - I'm seeking your advice to hopefully save a lot of work. ( I an ET in Dallas, just returned 

from Security training and has been designated the computer/network security person for our Division {ISSO?). He 
advised that HQ has mandated that he obtain all sorts of info from our systems/networks i.e: DCS 1000, DCS 3000, DCS 
5000, DCS 6000 etc. 

I I vants an accounting for all of the systems we, as TTAs & DCSPs, maintain. He wants to have diagrams, 
schematics, charts etc on what we have and how everything is connected. He wants lists of all of the general users and all 
of the limited/admin users. 


Is this duplicating what has already been done @ ERF w 1 the security certification for each system? Or is there a 
new mandate to have this info on file w/ the specifics for each individual field office? 

S aiso discussed restrictions regarding contractors and non employees working on, touching our systems, 
oned the phone company installers when they come to install/troubleshoot circuits etc. My understanding 
from this conversation is that they are not suppose to bring in computers, test equipment, etc that have memory etc. We > 9 
are suppose to supply the computers/equipment for them to use. 

I know that whenl tomes to install our new Vo iceBox. the week after next, that they will have their own 
computers flash drives eTTi know that when Ivas j ust here to upgrade our database they brought in laptops. Jb 7 E 

| I installers bring in test equipment & la'ptopsl |will have equipment to test the new DCS 3000 network 

connection in the new Frisco RA in the next couple of weeks. 

.How can we best handle this situation? Do 1 need to get a copies of the certification documents from ERF to give 

lor should we just walk him through our syste m and have him make diagrams, is there something in writing that I 

can reaa to better understand what I have to do when, | } , etc come into our space? 


How 

to | l or s 
can read to b 


Any advice, comments etc would be helpful. 


SENSITIVE BUT UNCLASSIFIED 
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=1 NY) (FBI) 

Monday. April 03. 200 6 4:49 PM 
■ |QTD) (FBI) 

RMS Submitted - - -RE: New York VBIII Upgrade to 3.6 


I submitted the RMS today (RMS Request Number: 01 10431). 


From: I I0TD) (FBI) 

Sent: Friday. March 31. 700*8:10 AM 

To: 1 I fNYI (FBI) 

Subject: RE: New York VBIII Upgrade to 3.6 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


I spoke with the DCS3000 guys about getting the pen data to Chelsea and they can do it. Instead of the way we 
discussed with just piping over from our side of the PIX they have a task force office solution that they developed for 
situations like this which will add an additional DCS machine in the main office that will act as a buffer for the task 
force pen data and prevent any possibility of snooping for other data. We will need to get a RMS in for this equipment 
to the DCS3000 team as soon as possible. 


Original Message — 

From: I I f NY - ) (FBI) 

Sent: Friday. March 31. 2006 3 : 19 AM 

To: I LmiDi(FBI) f 

Cc: I |NY) (FBI)J 

Subject: New York VBIII Upgrade to 3.6 
Importance: High 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


IZZI 


Reference our conversation Wednesday, 3/29/06, and my conversation wlth l h t JSI, Monday, 3/27/06, 
regarding upgrading the New York Voicebox system to version 3.6 in the near future. 

As requested, here's a recap of what we discussed regarding upgrading the New York VoiceBox system to 
version 3.6. As we all know, there is never an ideal time that will not cause any impact. 

seDr£t v (51) 


lb 6 
ib7C 


S08^ET 


Fr om t he standpoint of the impact on Title Ills, New York is presently running approximate! ! c ollections, of 
whicfiare consensuals that run continuously. It would be unusual for us to have fewer Tills that we currently 
have, and it is expected that all c ollect ions will increase due to an upcoming inspection scheduled for the Fall. 
During the last inspection we had] active Title Ills, and a large number under review for trial. 

To remove some of the pressure we have had in the past during upgrades, if we upgrade our l l ite first, 

we can movel pollections to that site. It would allow our personnel to gain experience with the new version while 
the CMP site is upgraded. We also now have some VoiceBox equipment at our RAs that might be used if needed. . 

ipoken with one of our ETs, and if it is ok with ERF to do so, we can route the VBIII pen data over to 
[using some spare bandwidth the ETs could proivide on an existing link to Chelsea. 

We have already sen d I ndividuals through the version 3.6 training at JSI in Sterling, VA, so that should 
help during the switch to the new version. 


I I havft| S[ 


Several cases are under review for trial, so we may need to export that data so the Agents have access to it if 
there is any long delay in completing the upgrade. 

| j jSI expressed that he is comfortable with upgrading us. Cleveland had a very large database that provided 
a basis for how long the New York upgrade may take. 

I I BAE - New York, is aware of the above and will be working on the j { site to insure it is 

ready for the 3.6 upgrade (Service Pack installed, etc). 

I will be speaking with the Case Agents to let them know of the possibility of the. upgrade and to see if there is 
anything else to consider from their standpoint. 


^U MM. New Vo rl 



IK New VorV 

2lj 
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SENSITIVE BUT UNCLASSIFIED 
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I spoke with the DCS3000 guys about getting the pen data to Chelsea and they can do it. Instead of the way we discussed 
with just piping over from our side of the PIX they have a task force office solution that they developed for situations like 
this which will add an additional DCS machine in the main office that will act as a buffer for the task force pen data and 
prevent any possibility of snooping for other data. We will need to get a RMS in for this equipment to the DCS3000 team 
as soon as possible. 

be 
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Subject: New York VBIII Upgrade to 3.6 

Importance: High 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Reference our conversation Wednesday, 3/29/06, and my conversation withl lat JSI, Monday, 3/27/06, regarding 
upgrading the New York Voicebox system to version 3.6 in the near future. 

As requested, here's a recap of what we discussed regarding upgrading the New York VoiceBox system to version 
3.6. As we ail know, there is never an ideal time that will not cause any impact. 

From the standpoint of the impact on Title Ills, New York is presently running approximately! [collections, of which 
flare consensuals that run continuously. It would be unusual for us to have fewer Tills that wecurrently have, and it is ^,7 
expected that all collections will increase due to an upcoming inspection scheduled for the Fall. During the last ^-7, 

inspection we had! Ictive Title Ills, and a large number under review for trial. , fc 7 E 

To remote some of the pressure we have had in the past during upgrades, if we upgrade our l i ite first, we 

can movqpoiiections to that site. It would allow our personnel to gain experience with the new version while the CMP 
site is upgraded. We also now have some VoiceBox equipment at our RAs that might be used if needed. 

I have spoken with one of our ETs, and if it is ok with ERF to do so, we can route th e VBIII pen data over to Chelsea 
using some spare bandwidth the ETs could proivide on an existing link to I 1 

We have already sen d i ndividuals through the version 3.6 training at JSI in Sterling, VA, so that should help 
during the switch to the new version. 

Several cases are under review for trial, so we may need to export that data so the Agents have access to it if there 

SJ^ET X < 55 > 
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is any long delay in completing the upgrade, 

a SI expressed that he is comfortable with upgrading us. Cleveland had a very large database that provided a 
r how long the New York upgrade may take. 

I I BAE - New York, is aware of the above and will be working on thq pite to insure it is ready 

for the 3.6 upgrade (Service Pack installed, etc). ~ 

I will be speaking with the Case Agents to let them know of the possibility of the upgrade and to see if there is 
anything else to consider from their standpoint. 


C ' MP ' , ' Klew Yo rk 
2121 loffice 

609| |cell 
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OK- 


It appears that as of last week the CDC wa s being sent with th e audio. There was no delay. We ran it with the CDC and 
CCC split all weekend and the Admin Agen| | monitored the timeliness of the CDC delivery and reported 

no delays. During this time she lost no audio, including during Call Waiting calls. 



e ing appeared to work correctly until the audio was lost. So as not risk losing another pertinent call waiting call SA 
requested the CCC and CDC be received separately. I switched the Title III back to separated CCC and CDC at 
2014 VoiceBox time) 

fo6 



I decided to take this opportunity and reset the time on the VoiceBox system, since we are going up on another T-lll 
03/28/06 and possibly 3 more by the end of the week. /r^ 







Sf^ET 

I am going to do the shutdown process (workstations, RWS1&2, CD-R 1&2, Site Manager). Then reset the time on the 
Server. Then power everything back up in reverse order (one at a time). Hopefully this will correct the time issue. 

If there are any problems then you will receive another email from me. Otherwise No email = no problems. 
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From: 1 D TD1 (FBI) 

Sent: Wednesday. M arch 22, 2006 0:28 AM 

To: I I OTP) (FBI) 

Subject: RE: ir information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


This is tied primarily to future requests for money, 300 exhibits and requisition in FY07 and forward. However, the 
cost of each system should be looked at so we can determine our investment and support needs that are truly IT. 
We would like to know the cost of the part of each system that is IT (that allows our collection systems to connect 
to trilogy, operate remotely over an IT system, prepares data to be sent over/to an IT system). 

I know this is a little vague but we need an estimate with some basis behiond it. 


From: bTD) (FBI) 

Sat *- Iuowj-.ii. i u nJ irrh 22, 2006 9:14 AM 

To: I I OTP) (FBI) 

Subject: RE: IT Information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 

I t riCTU personnel have asked that you specify what time period you are inquiring about, as well as 
defining what you consider IT to be. Are you asking about costs from the inception of projects that could date 
back years, or something else? Thanks. 


Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 


Suanticn Virginia 

ro €Z f 


— Original Message 

From: P" 

Sent: 3 


T OTD) (FBI) 

■ynsdav.' March 7.0 006 4:11 PM 

T Information Request - Needed by Friday 3/24 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems 
listed on the OCIO master list of systems, applications, databases, and networks. For the 
systems/projects listed below, please determine or estimate as best you can the cost of the hardware, 
software, and the development work for the interface to the Trilogy network or other FBI IT infrastructure. 
This will help us separate the funding of National Security Systems that are not truly IT from IT systems, 
databases, applications and networks. Please provide an estimate by Friday 3/24. 



EDMS - IT Interface 
DCS 6000 - IT Interface 
DCS 3000 - IT Interface 
DCSNet (CALEA transport) 
CARTSAN - IT Interface 
oily of Systems 


se)$et 


Central ivionitoring Plant Network 

Central Mnnitnrinn Plant Systems Operations Center (CSOC) 


b2 

fo7E I 


hltjUK Management technology Unit 
Efectronic Sg^eillaflisJ'echnology Section, OTD 
Phone: 7n? J I. 

Cell: 202-1 

Fax: 


SCZI 
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Subject: RE: IT Information Request - Needed by Friday 3/24 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


The DCS6000 is a Title III telecommunications collection tool, it currently has no interface to Trilogy or other FBI-IT 
network. The DCS6000 does produce some reports that are sneaker-netted to TA and printed for ELSUR. The answer for 
now is zero dollars. 

The DCS6000 does have a connection to the DCSNET for collection of CALEA data from intercepts. This network 
is paid for controlled wholly by the TICTU unit. This network also gives the DCS6000 the ability to perform some remote 
maintenance duties. 

Looking to the near future the DCS6000 we do not see a connection directly to the Trilogy network as the 
DCS6000 is an unclassified network. We do see the need to develop a network that will allow us the bandwidth to process 
Title III telecommunications collections from remote offices while maintaining the core systems in central division offices 
for administrative purposes. It is unclear at this time if this would fall under a request for IT services or funded and 
maintained out of TICTU/Field Office operating expenses. 



Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 


Quantico. Virginia 

70 l 7,1 be 
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— Original Message 

From: I l (OTP) (FBI) 

sent: Werinwriav M arch 22, 2006 9:28 AM 

To: I l OTO) (FBI) 

Subject: RE: IT Information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


I I («) 
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This is tied primarily to future requests for money, 300 exhibits and requisition in FY07 and forward. However, the cost 
of each system should be looked at so we can determine our investment and support needs that are truly IT. We 
would like to know the cost of the part of each system that is IT {that allows our collection systems to connect to trilogy, 
operate remotely over an IT system, prepares data to be sent over/to an IT system). 

I know this is a little vague but we need an estimate with some basis behiond it. 

Jhanks. 


— Originaljtesage—-' 

From: I I fOTDi (FBI) 

Sent: Wednesday, March 22, 2006 9: 14 AM 

To: I " 1 (OTP) (FBI) 

Subject: Ft: II Information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


I F riCTU personnel have asked that you specify what time period you are inquiring about, as well as defining 
what you consider IT to be. Are you asking about costs from the inception of projects that could date back years, 
or something else? Thanks. 


Telecommunications Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 


be 
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1 I OTP) (FBI);. 

IT Information Request - Needed by Friday 3/24 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed 
on the OCIO master list of systems, applications, databases, and networks. For the systems/projects listed 
below, please determine or estimate as best you can the cost of the hardware, software, and the development 
work for the interface to the Trilogy network or other FBI IT infrastructure. This will help us separate the 
funding of National Security Systems that are not truly IT from IT systems, databases, applications and 
networks. Please provide an estimate by Friday 3/24. 

EDMS - IT Interface 
DCS 6000 -IT Interface 
DCS 3000 - IT Interface 
DCSNet (CALEA transport) 

CARTSAN - IT Interface b2 

i!y of Systems b2E 


Central Monitoring Plant Network 

ant Systems Operations Center (CSOC) 
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Thanks, 
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1 If OTP) (FBi)l 

lOTDWFBIVl 

JOTD) (FBI); 
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DTD) (FBI) 


Cc: 

l IOTD) (FBi)'.l 

|OTD)(FBI),r^ 

□_ (OTP) (FBI); 


1 l(OTDj (CUN) 



Subject: 

FW: 1 1 information Request - Needed by Friday 3/24 



SENSITIVE BUT UNCLASSIFIED 
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Pis see below. 


Telecommunications Intercept and Collection Technology Unit (TICTU) ® 
Electronic Surveillance Technology Section b7C 

Operational Technology Division 

SC3 
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From: \ l oTm (FBI) 

Sent: jJtolaeatoi-Jtfarch 22, 2006 9:28 AM 

To: I t fOTD) (FBI) 

Subject: RE: U Information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD be 

b7C 


I 1 

This is tied primarily to future requests for money, 300 exhibits and requisition in FY07 and forward. However, the cost of 
each system should be looked at so we can determine our investment and support needs that are truly IT. We would like 
to know the cost of the part of each system that is IT (that allows our collection systems to connect to trilogy, operate 
remotely over an IT system, prepares data to be sent over/to an IT system). 

I know this is a little vague but we need an estimate with some basis behiond it. 

Thanks . 

□ 


— Original Message — 

From: I ~f pTD) (FBI) 

Sent Wednesday. March 2 2. 2006 9 : 14 AM 

To: | |(OTD) (FBI) 

Subject: Rfc: I! information Request - Needed by Friday 3/24 

SENSITIVE BUT UNCLASSIFIED f 6 

NON-RECORD ° /c 


I h cTU personnel have asked that you specify what time period you are inquiring about, as well as defining what 
you consider IT to be. Are you asking about costs from the inception of projects that could date back years, or 
something else? Thanks. 


Telecommunications Intercept and Collection Technology Unit (TICTU) 
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— OrigmgJJjssssiggi 
From: I 

Sent: TnPgria'/ Mai 


^OTD) (FBI) 
L2fl0f4:llPM _ 
|(OTD) (FBI)|_ 
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TD) (FB I) I* 
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*~| (QTD) (FBI)J^ 


loTPI fFBpf 


H(rrD) 


Subject: IT Information Request - Needed by Friday 'ijlA 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


JPTO) (FBI) 


J(ITD) (FBI);|_ 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed on 
the OCIO master list of systems, applications, databases, and networks. For the systems/projects listed below, 
please determine or estimate as best you can the cost of the hardware, software, and the development work for 
the interface to the Trilogy network or other FBI IT infrastructure. This will help us separate the funding of National 
Security Systems that are not truly IT from IT systems, databases, applications and networks. Please provide an 
estimate by Friday 3/24. 

EDMS - IT Interface 
DCS 6000 - IT Interface 
DCS 3000 - IT Interface 
DCSNet (CALEA transport) 

CARTSAN - IT Interface 
PART Fami|/ of Systems 

Central Monitoring Plant Network b7E 

Central Monitoring Pl ant Systems Operations Center (CSOC) 


Thanks, 


ELSUR Management Technology Unit 


lb 2 
Jo 6 
fc7C 
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I I(OTD) (FBI) 

JfltedflfiSdatt March 77 2006 8:59 AM 

Li^f- 

Qe>)(F6|) |(OTD) (FBI);| 

FW: IT Information Request - Needed by Friday 3/24 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


| p lease coordinate a response t< | | 

All, Pl ease see below message and ascertain your costs associated with the listed systems/projects. Please provide this 
info tol 1 by Thursday, 3/23/06. 


j Please assist! [vith a coordinated response 
necessary. Thanks. 1 


Note deadline of 3/24/06. Reminders as 


I elM4MiWurti4Mions Intercept and Collection Technology Unit (TICTU) 
Electronic Surveillance Technology Section 
Operational Technology Division 


Qu 
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From: [" 

Sent: T 


[ OTP) (FBI) 

rcK 21,2006 4:11 PM 

. ^crrm (FBI)l 

KO TO) (FBTJ 

’ (FBI) t 

IOTP) (FBI): I 

in Request - Needed by Friday 3/24 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Marcus Thomas has asked that we determine the cost of the IT portions of the OTD collection systems listed on the OCIO 
master list of systems, applications, databases, and networks. For the systems/projects listed below, please determine or 
estimate as best you can the cost of the hardware, software, and the development work for the interface to the Trilogy 
network or other FBI IT infrastructure. This will help us separate the funding of National Security Systems that are not truly 
IT from IT systems, databases, applications and networks. Please provide an estimate by Friday 3/24. 

EDMS - IT Interface 
DCS 6000 - IT Interface 
DCS 3000 - IT Interface 
DCSNet (CALEA transport) 

CARTSAN - IT Interface fo2 

■ PART fam ily of Systems b 7 E 


Central Monitoring Plant Network 

Central Monitoring Plant Systems Operations Center (CSOC) 
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ELSUR Management Technology Unit 
Electronic Sui^gjUaijfigJ'echnology Section, OTD 
Phone: 7Q3 
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I(OTD) (FBI) 

■ Wednesday, MarcW 2006 112LAM 

|OTD).fFBIVl 

rurrf (FBi)I 

Hfbtt I ' i flYtas/ Feir 

FW: Privileged User Role-Based Training 


UNCLASSIFIED 

NON-RECORD 


I believe below would be your unit's call. 
Please advise. 

Thanks. 


1 j Enterprise Operations Services 00 

Elsur Technology Management Unit (ETMU) bTC 

Electronic Surveillance Technology Section (ESTS) 
Operational Technology Division (OTD) 

ERF, Ouantico. VA 
Tel: S4d ~1 

Fax: 5401 I 


— Original Mesa 

From: 

Sent: 


UNCLASSIFIED 

NON-RECORD 


I (OTD) (CON) 
iy, March 07, 2006 5:20 PM 

l oro) (FBI) 

f (ITD) (CON) 

viieged User Role-Based Training 


Even with the extension of time to complete the training associated with being a privelaged user, we should probably 
identify which systems need to have the privelaged user Ruels of Behavior (ROB) created for. As I see it there am 
primarily three systems that are supported by the DCSP that each should have a ROB form. They are th j | 

System (DCS5000) the Voice Box System (DCS6000) and the DCS3000. My understanding is that each of these will be 
accredited at an enterprise level such that the system in Albany and the system in Portland both fall under a single ROB. hz 
But the three separate type of system each require their own ROB. So each system administrator will fill out three ROBs.fo 7 

The form on the Security page ! b nlv has a 

generic Rules of Behavior form that requires system name entry. To avoid confusion, I would recommend that TICTU 
identify how they want the system names to appear on the ROB. I believe that since each system is acredited seperatly 
that a unified "ELSUR Systems" ROB would not be in order. 


X 


From: I l (CG) (CON) 

Sent: , Thursday. February, 2006 1 0:35 am 

To: I — LQTP) (FBI) , 

Cc: |lTD) (CON)| |OTD) (FBI);| j 

1 TO TO 1 1 1 1 1 

Subject: RE: DCS60D0 Remote 


fo6 

UNCLASSIFIED b7C 
NON-RECORD 


Thanks, I was just inquiring just in case it was not thought of or became a stopping block as you moved forward. 


b6 


— Original 

From: 

Sent: 

To: 

Cc: 

Subject: 

UNCLASSIFIED 

NON-RECORD 


a recent discussion with the Office of the General Counsel, monitoring/coliecting in different jurisdictions is not 
an issue. In U.S. v. Denman , 100 F.3d 399 (5th Cir. 1996) the court stated "(w)e agree with the reasoning of the 
Second Circuit and now hold that interception includes both the location of a tapped telephone and the original 
listening post, and that judges in either jurisdiction have authority under Title 111 to issue wiretap orders." The original 
citing for this came from U.S. v. Rodriguez 968 F.2d 130 (2d Cir. 1992). In this case, interception refers to where a 
communication is initially obtained regardless of where it is being heard. Also, to my knowledge the DEA has had no 
challenges to their hub (regional) collecting. I suggest you refer this matter to your CDC for additional guidance. The 
DCS-6000 team is still working on the technical end of making the remote workstation happen. 

□ 



FW: DCS6000 Remote 


JOTD) (FBI) 

' 1006 7:50 AM 
(CG) ( ysm 


|ffD) (CONj_ 


□(OTD) (FBI) 


— Original Mggaflft.— 

From: 1 If OTD I (FBI) 

Sent: Friday. January 13. 2006 2:39 PM 

To: I I (ITD) (CON) 

Cc: I iOTD) (FBI) 

Subject: Aa/: btSsUOO Remote 


UNCLASSIFIED 

NON-RECORD 


— Origin al Message — 

From: I I (CGI fCONl k>6 

Sent: Friday. January 13 2006 12:10 PM 3b 7 C 

to: I ™rm (FBI) 

Cc: I I f CGI (FBI) 

Subject: DCS6000 Remote 


RMS# 105654 - Previously submitted requesting DCS6000 remote capability (Assigned to I I - Status is 

Working « 


SEjtffT X 


( 74 ) 


SE^T 


Per our discussi on, here are some items of interest/or concern with regards to DCS6000 remote workstations. Also, I 
have talked with ! fe nd his is in agreement that Chicago would like to be a test site once this capability 

exists. We would be interested in an estimated time frame that this could happen and if there is anything that could be 
done to speed up the release of this technology. 


Concerns/or Issues that may need to be addressed: 

Legal - Monitoring/collecting in different jurisdictions 
Network - Minimum bandwidth, encryption 
Security - Encryption, Accreditation 


Possible requirements at a remote site: 

Computer(s) (DCS6000/3000) 

Router + (Tl's (Network connection/data) and/or ISDN's) 
Remote Server 


I l Chicago 

ELSUR Technology Management Unit 
Electronic Surveillance Technoloav Section, OTD 
312| [Desk) 

312 (Fax) 

31 ^ pell) 


fo2 

b6 

b7C 


UNCLASSIFIED 

UNCLASSIFIED 

UNCLASSIFIED 



X 


( 75 ) 


From: 

Sent: 

To: 

Cc: 

Subject: 


I If OTD) (FBI) 

ihursdav. February 23, 20 06 8:50 AM 
| I fCfl) (Q£m_ 

(CON)J 


TW: LlOyBUUU Remote 


](OTD) (FBI) 


be 

UNCLASSIFIED b 7 jg 

NON-RECORD 


In a recent discussion with the Office of the General Counsel, monitoring/collecting in different jurisdictions is not 
an issue. In U.S. v. Denman , 100 F.3d 399 (5th Cir. 1996) the court stated "(w)e agree with the reasoning of the Second 
Circuit and now hold that interception includes both the location of a tapped telephone and the original listening post, and 
that judges in either jurisdiction have authority under Title III to issue wiretap orders." The original citing for this came from 
U. S. Rodriguez 968 F.2d 130 (2d Cir. 1992). In this case, interception refers to where a communication is initially 
obtained regardless of where it is being heard. Also, to my knowledge the DEA has had no challenges to their hub 
(regional) collecting. I suggest you refer this matter to your CDC for additional guidance. The DCS-6000 team is still 

a on the technical end of making the remote workstation happen. 


Original M 

From: 

Sent: 


1 


Subject i*- 1 " 


UNCLASSIFIED 

NON-RECORD 


loTP'l (FBI) 
TTinnK 2:39 PM 

__r°) (CON) 

JTdTD) (FBI) 
femote 


fob 

b7C 


— Original Messa 

From: j 


To: 

Cc: 


Z|(CG) (CON) 

2006 12:10 PM 
OTD) (FBI) 
□|(CG)(FB1) 


Subject: DCS6000 Remote 


b6 

b7C 


RMS# 105654 - Previously submitted requesting DCS6000 remote capability (Assigned 
Working 


- Status is 


Per our discus sion, here are some items of interest/or concern with regards to DCS6000 remote workstations. Also, I 
have talked wit j l and his is in agreement that Chicago would like to be a test site once this capability 

exists. We would be interested in an estimated time frame that this could happen and if there is anything thatcouid be 
done to speed up the release of this technology. 


Concerns/or Issues that may need to be addressed: 

Legal - Monitoring/collecting in different jurisdictions 
Network - Minimum bandwidth, encryption 
Security - Encryption, Accreditation 


Possible requirements at a remote site: 

se£k£t 


( 76 ) 


X 


se^Ket 

Computers) (DCS6000/3000) 

Router + (Tl's {Network connection/data) and/or ISDN's) 
Remote Server 



UNCLASSIFIED 

UNCLASSIFIED 


Sf^ET 


X 


( 77 ) 



SBBBET 


From: I I tOTD) (FBI) 

Sent: Friday, October 07, 2005 7:46 AM 
To | 1 ruoDVCor^ 

Subject: RE: Pen Registerl 


b 6 
fo"C 


UNCLASSIFIED 

NON-RECORD 


Our vendor is in the process of rolling out a updated version of their a pplication and we hope to start deploying this 
release in 2006. We will revisit the possibilty of the th q | >tion in that release. 




--Or 

From: 

Sent: 

iginal Message — 

1 UODYCON) 

Wednesday, October I 

35, 2005 8:05 AM 
) f FBI') 

To-T - 

~l(OTD 

Subject: RE: Pen Register j 

L_ i 


b6 

UNCLASSIFIED b7C 

NON-RECORD 


□ 

This is a follow-up to the meeting you had with TA on June 1, 2005. 1 was 
wondering if the contractors working on the J3094 voice box file made any progress with 
adding or using an existin g field to the J3094 voice box file to indicate if a telephone 
number isl ”’""1 


be 

b7C 


I 


— Ori ginal Message — 

From: I ~~1 ('ITQDXCQNI 

Sent: Wednesday, May 18, 2005 10:41 AM 

To i r OTDUEBtt . 

Subject: RE: Pen Register -| | b2 

b7E 


UNCLASSIFIED 

NON-RECORD 



b2 

fe7E 


b2 

b?E 


X 


( 79 ) 



IZZI 


SEI 




This is a follow-up to the phone conversation that we had on June 2, 2005. i was wondering if you were 
' i. I will be on vacation on May 20, 2005 thru May 30, 2005. Could you tell 
DNRS and J3094 data time are captures as real time or GMT? Will the 
aa or use an existing field to the J3094 voice box file to indicate if a telephone 



Original Message 

From:| I (ITODXCON) 

jenti Friday. May fife. 2665 5:2ft AM 


tT 


Subject: Pen Register 


J(OTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


From i | lTOD)(CON) 

Sent, rndav. Aprils, zm ft 57 AM 

To ! I (ITOD)(CON) 

Subject: FW: Re current pen registers 


UNCLASSIFIED 

NON-RECORD 


Original M 

From i I 

Sent: Thursday, February 20, 2003 9:48 AM 

51 7 I 

Subject. Re: Re current pen registers 


CM2210 (system no longer used) I am not sure if new format is used by another 
system. 

ADNRS (system no longer used) 

PCS (system no longer used) 

CDNRS (system no longer used) But, upload format used by DCS3000 
RDNRS (no longer used) 

JSI - what format is this? 

DISCOVERY - not being used 

SElJR^T 


X 


( 80 ) 





J3094 - format being used 
DCS - format being used 
DMW - format being used 



VOICE-ID - 1 did not know there was a format 


PINE - {system no longer used) 

NOKIA - 1 did not know there was a format 


DCSPC - is this similar to DCS? 

[ | system being used; using DMW format 

ICD-1 4 - format being used 


Something to keep in mind most of these formats need updating to 

include more fields of data that is being collected but unable to be passed to 
TA because TA database presently is not coded to handle. Have spoke tq j 

about this and it was decided that we should have a meeting with All to I I 

discuss this and provide reports, files etc. for TA to decide how to handle. 


fo6 

b7C 


b .2 
hit 


Telecommunications Intercepts 
Collection Management Unit (TICTU), 
Electronic Surveillance Technology Section 
Information Technology Division 
ERF, Quantico, VA 


Tel: 703 
Fax: 703 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


:T 


X 


( 81 ) 




This is a follow-up to the meeting you had with TA on June 1, 2005. I was wondering if the 
contractors working on the J3Q94 voice box file made any progress with adding or using an 
existing field to the J3094 voice box file to indicate if a telephone number is push-to-talk? 



— original Message — , 

Froni r TTQDYroNi 

Se nt: Wednesday. Mav 18, 2005 10:41 AM 

to ! . I coTpuean 

Subject: RE: Pen Register -1 


be 

b7C 


UNCLASSIFIED 

NON-RECORD 


□ 


This is a follow-up to the phone conversation that we had on June 2, 2005. 1 was wondering if you were able 
to agree on a meeting date . I will be on vacation on May 20, 2005 thru May 30, 2005. Could you tell me 
whether M I CDNRS and J3094 data time are captures as real time or GMT? Will the co ntractor 

* a add or use ah existing field to the J3Q94 voice box file to indicate if a telephone number is I I 


j o 


be 

b7C 


□ 


Original Message- 


From: | t lTODVCONi 

Sent: Friday, May 06, 2005 9:28 AM 
Tol l(OTD) (FBI) 

subjmrraTrogtsrer 


UNCLASSIFIED 

NON-RECORD 


From: I i TomrcoNt 

TmV FnHaW AnHI ?nni ^iTnn;-.( CON) 

Subject: FW: Re current pen registers 


UNCLASSIFIED 

NON-RECORD 



(84) 


X 


b2 

b7E 



— O riginal Message — 

From. r I 

Se nt: Thursday, Februa ry 20, 2003 9:48 AM 


Subject: Re: Re current pen registers 


CM2210 (system no longer used) I am not sure if new format is used by another 
system. 

ADNRS (system no longer used) 

PCS (system no longer used) 

CDNRS (system no longer used) But, upload format used by DCS3000 

RDNRS (no longer used) 

JSl - what format is this? 

DISCOVERY - not being used 

J3094 - format being used 
DCS - format being used 
DMW - format being used 

VOICE-ID - 1 did not know there was a format 

PINE - (system no longer used) 

NOKIA - 1 did not know there was a format 

DCSPC - is th is similar to DCS? 

I * | system being used; using DMW format 

ICD-14 - format being used 

Something to keep in mind most of these formats need updating to 

include more fields of data that is being collected but unable to be passed t o 
TA because TA database presently is not coded to handle. Have spoke tol 
about this and it was decided that we should have a meeting with All to • 
discuss this and provide reports, files etc. for TA to decide how to handle. 


Telecommunications Intercept & 

Collection Management Unit (TICTU), 
Electronic Surveillance Technology Section 
Information Technology Division 
ERF, Quantico, VA 


) 3 | | 


UNCLASSIFIED 


X 


From: » \ CV) (FBI) 

Sent: Monday. January 23. 2006 10:49 AM 

To: b/c I l iOTDHFBh 

Subject: APC UPS 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


□ 

As per out telephone conversation about the two APC UPS malfunctioning (batteries swelling up). We were wondering if 
we could RMS the units or the batteries. The Unit serial number is SU1400RM2U. These units were installed by a 
contractor called AQC in 2002 when we moved to this building. They came and installed the racks that have the DCS 
3000. Thanks 



SENSITIVE BUT UNCLASSIFIED 



X 


( 87 ) 


From: 

Sent: 

To: 

Cc: 

Subject: 


I 1 (OTD) (FBI) 

Friday, January 15,' 2 006 2:39 PM 

TD^ 

I f OTD) (FBI) 

FW: DCS6000 Remote 


— Original M« 

From: 

Sent: 

To: 

Cc: 

Subject: 



JCG) (CON) 


b6 

lb7C 


RMS# 105654 - Previously submitted requesting DCS6000 remote capability (Assigned tol [- Status is 

Working I-—--— -J 


Per our discuss ion, here are some items of interest/or concern with regards to DCS6000 remote workstations. Also, I 
have talked with| pnd his is in agreement that Chicago would like to be a test site once this capability 

exists, We would oe interested tn an estimated time frame that this could happen and if there is anything that could be 
done to speed up the release of this technology. 


Concerns/or Issues that may need to be addressed: 

Legal - Monitoring/collecting in different jurisdictions 
Network - Minimum bandwidth, encryption 
Security - Encryption, Accreditation 


Possible requirements at a remote site: 

Computer(s) (DCS6000/3000) 

Router + (TVs (Network connection/data) and/or ISDN’s) 
Remote Server 


I I Chicago 

ELSUR Technology Management Unit 
Ele ctronic Surv eillance Technology Section, OTD 
31 2 j |(Desk) 

312 |Fax) 

3121 [Cell) 


fo2 
lb 6 
b7C 


UNCLASSIFIED 

#et x 


( 88 ) 




Per our discussi on, here are some items of interest/or concern with regards to DCS6000 remote workstations. Also, I 
have talked with l b nd his is in agreement that Chicago would like to be a test site once this capability 

exists. We would be interested in an estimated time frame that this could happen and if there is anything that could be 
done to speed up the release of this technology. 


Concems/or Issues that may need to be addressed: 

Legal - Monitoring/collecting in different jurisdictions 
Network - Minimum bandwidth, encryption 
Security - Encryption, Accreditation 


Possible requirements at a remote site: 

Computer(s) (DCS6000/3000) 

Router + (Tl's (Network connection/data) and/or ISDN's) 
Remote Server 



Chicago 


ELSUR Technology Management Unit 



sillance Technology Section, OTD 
Desk) 

: ax) 


)ell) 


lb 2 
b6 
!o7( 




foe 

SENSITIVE BUT UNCLASSIFIED fc7C 

NON-RECORD 


□ r t 

You are correct there is not a new date yet. I b t ERF informed me that Yuma was originally scheduled for 

November 27th of 2006. 1 I is leaving the Voice Box program for another department and he asked me to work with 
i I vith regards to moving the instal lation date up. I believe JSI will begin the 2006 installation schedule 

sometime in late February. I'm confident that | [ will let us know if they can move your date up. I have included him with 
this email. 


Thanks, 



SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


[=□ 

The VBII1 upgrade equipment was delivered to the Yuma RA today. I expe ct that this delivery has no direct 
relationship to when the equipment will be installed, but that has not stoppel land everyone else from asking 

about it. 

Unless you tell me differently, I am under the assumption that ERF is still finalizing their install schedule & they have 
not yet given a Yuma install date. 

Please let me know if I am off track so I can keep the wolves at bay. 

□ 

— Oriqjml Mf-viflnp — . ■ - 
From: I fo x) (TOW 

Sent: Monday. December 19. 200 5 11:05 AM 

To: I t PXHFBI) fog 

Subject: RE: Yuma's upcoming Tills j~ 7c 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


”CZ=I 

Thanks for getting back so soon. The DCS lines will be Calea and should be fairly easy to move over to the VB. 
It's just a matter of getting the Telco to comply in a timely fashio n. They will "Ring -Down" the POTS as indicated. 
We will have to let them know what POTS lines to call. I believe | | are working on a solution for the 

SE$|T y (90) 


S^ET 


two "Orphan" lines. I suggested possibly getting ERF involved with installing the other equipment ] | will 
ultimately make that decision. Thanks again and if I don't talk to you before then have a Merry Christmas. 

Sincerety, b6 

□ 


St 


I I (PX) (FBI) 

Mon day. December 19, 2005 10:57 AM 
|PX) (CONI 


sun 

j(p> 


IPX) (FBI-) I 


JPX) (FBlJ_ 


JPX) (FBI|_ 


IbllCONj 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


h2 

b7E 


bfi 

b7C 


To further clarify your mission, two of the ] ^j ines currently under collection on the DCS 3000 will be routed 
into the VB for audio collection. If any prep work is necessary for the VB transition of these two lines in 
particular, let me know, so we can plan for it. 


Mathematically, that means we a 
alternate collection system. 


Thanks for the assistance. 


i bumping two current lines off the VB into the yet-to-be-determined 


— Original Mes 

From: | 

Sent: 


I pyi (con) 

Monday. December 19. 2005 10:47 AM 
-J(PX) (FBI; 


, M (CON] 


3 wC 


~lPX) iTRiir 


3 PX ) (FBI)J 


IpX)(FBI)r 


Subject: njmay upturning Tills 

SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


WP: 

be 

b7C 


b7C 

b7F, 


1=1 

I have made plans to travel to | | AZ on January 4th and 5th to provide support for the Voice Box 
System. I will answer any software oj- hardware questions and stick around as long as necessary on 
Thursday. If it is determined that allMcurrent Trap/Trace targets which are! 


found. There has been discussion of installing a rack mounted DNR ' o be clear, 

my focus/support will be directed towards the Voice Box System not the alternate collection systems. 
Ouring downtime I will be more than happy to provide any help I can with any tasks to complete the 
mission. 


Regards, 


I , IeOSO) bb 

Electronic Surveillance Technology Section (ESTS) b7c 

Op erational Te chnology Division (OTD) 

602 fDesk) 

si S) S^lfET ( 91 ) 


X 


From: 

Sent: 

To: 

Subject: 


b6 

b7C 


]OTD) (FBI) 


S^4 t 


t 


l(OTD) (FBI) 
' ^amB5pra05 2:47 PM 
ZZZllDTD) (FBI) 


___UpT[ 


UNCLASSIFIED 

NON-RECORD 


fo2 

b7E 


— Or iginal Message — 

From: ! I (CG) (CON) 

Se nt: Friday. November 18, 2 005 11:15 AM 
-fOTD) (FBI) 


Cc :l 

Subject: VoiceBol 


B 


(CG) (CON); f" 


UNCLASSIFIED 

NON-RECORD 


](CG) (CON);[ 


](CG) (CON) 


b2 

b7E 




There have been recent upgrades to Telephone Apps that allow the u pload o n L l ata. The TS personnel in our 

office c an now upload for the DCS3000 to TA directly I I When these l I taraets go Title III, we move the 

1 j ver to the VoiceB ox and there is no current report which is compatible for upload to TA. I have tried to modify the 
current VoiceB oj R eport with no luck. I do not know enough about the data that is captured by TA. Is there a plan to 
possibly have JSi create a report which can be uploaded to TA or will they have to continue to use hard copies of this 
data? This would be a great help to our folks here in Chicago. 


Please let me know if i can be of any assistance. 
Thanks, 


ELSUR Technology Management Unit (ETMU) 
Ele ctronic Surv eillance Technology Section, OTD 
iDesk) 

Fax) 

Ceil) 


312 

312 

312 


ctronic Survei 

O 


b2 

be 

b7C 


UNCLASSIFIED 


UNCLASSIFIED 


. ( 93 ) 

SE^T 


x 



UNCLASSIFIED 

NON-RECORD 



This is a follow-up to the phone conversation that we had on June 2, 2005. 1 was wondering if you were able 
to agree o n a meeting date. ! will be on vacation on May 20, 2005 thru May 30, 2005. Could you tell me 
whether th d b DNRS and J3094 data time are captures as real time or GMT? Will the contractor 



From ! " “ ~\ (rTOD)(CON) 

H t: Friday. May 06, 2005 9:28 AM 
I OTP) (FBI) 

ject: Pen Register 


UNCLASSIFIED 

NON-RECORD 


From I l lTOnUCONt 

Rant- Friday Anril 15 2005 9.S7 AM 
To ! j lTODXCON) 

Subject: FW: Re current pen registers 

UNCLASSIFIED 

NON-RECORD 

b6 






CM2210 {system no longer used) I am not sure if new format is used by another 
system. 

ADNRS (system no longer used) 

PCS (system no longer used) 

' CDNRS (system no longer used) But, upload format used by DCS3000 

RDNRS (no longer used) 

JSI - what format is this? 

DISCOVERY - not being used 

J3094 - format being used 
DCS - format being used 
DMW - format being used 

VOICE-ID - 1 did not know there was a format 

PINE - (system no longer used) 

NOKIA - 1 did not know there was a format 

DCSPC - is this similar to DCS? 

■ | 

system being used; using DMW format fo 7 B 

ICD-14 - format being used 

Something to keep in mind most of these formats need updating to he 

include more fields of data that is being collected but unable to be passed to b ;c 

TA because TA database presently is not coded to handle. Have spoke to! | 

about this and it was decided that we should have a meeting with All to I I 

discuss this and provide reports, files etc. for TA to decide how to handle. 


^ l e f ^ oT r^miJhi^fiohS IhtefJ pt & 

Collection Management Unit (TICTU), h 2 

Electronic Surveillance T echnology Section h 6 

Information Technology Division | a7( 

ERF, Quantico, VA 


Tel: 703 
Fax: 703 



UNCLASSIFIED 


UNCLASSIFIED 


SECRET 


X 


( 96 ) 



Our vendor is in the process of rolling out a u pdated version of their application and we hope to start deploying this release 
in 2006. We will revisit the possibilty of the th 4 b ption in that release. 




— O riginal Message — 

From ! Z IrmnvnnM) 

Se nt; Wednesday, Oct ober 05, 2005 8:05 AM 
Toj |(OTD 

Subject: Kt: Hen Register - 

be 

b7C 



UNCLASSIFIED 

NON-RECORD 


This is a follow-up to the meeting you had with TA on June 1, 2005. I was wondering if the 
contractors working on the J3094 voice box file made any progress with ad ding or using a n 
existing field to the J3094 voice box file to Indicate if a telephone number id ** " 'j 



X 


( 98 ) 



SEj2fl£[ 


This is a follow-up to the phone conversation that we had on June 2, 2005. 1 was wondering if you were able to 
■ anfRft nn fi meeting date. I will be on vacation on May 20, 2005 thru May 30, 2005. Could you tell me whether the 

I pDNRS and J3094 data time are captures as real time or GMT? Will t he contractor hP ahl e to a add 

or use an existing field to the J3094 voice box file to indicate if a telephone number if 1 


fo6 

b7C 


,2 \ i 


— Oryimal M^anp — 


Sent: Friday, May 06, 2005 9:28 AM 


HrTOD)(CON) 


Subject: pen Register 


]OTO) (FBI) 


UNCLASSIFIED 

NON-RECORD 


UNCLASSIFIED 
NON-RECORD fo6 

blC 



Subject: Re: Re current pen registers 


CM2210 (system no longer used) I am not sure if new format is used by another 
system. 

ADNRS (system no longer used) 

PCS (system no longer used ) 

CDNRS (system no longer used) But, upload format used by DCS3000 
RDNRS (no longer used) 

JSI - what format is this? 

DISCOVERY - not being used 

J3094 - format being used . 

DCS - format being used SECRET 


X 


( 99 ) 





UNCLASSIFIED 


UNCLASSIFIED 




UNCLASSIFIED 


SEfcf^T 


X 


( 100 ) 


From: 

Sent: 


Subject: 


J(OTD) (FBI) 
iber 22. 2005 9:03 AM 


f FDTD) fFBhl 

IfOTm fFBivI I 

JEM ■ fOTDl (FBiE 

wvmwr&ir 




TOTBJ n, (Coli)J 


HD)(CON):r 


__J(ITD) (CONV.r 
J)TD) (CON); | 


id VB Systems 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD lbb 

b7C 


C3. e copied a message from the Ta[" 
current situation: *" 


J in New Orleans which will provide an update of their 


Would ya’ll forward this to whom ever you may think needs it, especially in the TICTU realm. Tomorrow, space b2 

management and FBI movers will commence moving all of our TA/ET/CMP equipment from New Orleans to our new fc7 e 
offsite loc ated at anl | This includes moving all CMP equipment (Voice Box, 

DCS3Qoo | p rej; 1 

During this move I am sure things will be damaged. We cannot leave anything in place for space management is to begin 
gutting our entire field office next week. In a perfect world, we will be back in our New Orleans office by the end of May, or 
early June ’06. In the interim our division will be scattered in bl dgs from Covinatp n. LA to Baton Rouge, with Baton Rouge f „ . 
having several bldgs housing d ifferent programs. ! have aske d lo contact TICTU, et at to help set up 

temporary DCS 3000, etc in ou | | As for as any CMP down here, I do not know at this time how that will 

evolve, but once we get all equlpmenr up iiyie irrBR, perhaps BAE could send some contractor types to check out all of 
our equipment. Also, I am sure we will have to surplus equipment but we will take it one step at a time. 


n 


Original Message— 

FronL ” 


J(OTD) (CON) 


Sent: Thursday, September 22, 2005 8:30 AM 
To:| lOTD) (FBI); | 

‘ tOTD) (fbH ' 1 


Te l _ ' I( OTD) (CON } r 

Subiect: FW: I fe nd VB Systems 


to 6 
to7C 


](OTD) (FBI)d 
| (OTD) (CON) 


](OTD) (FBI) | | 


fc2 
ib 7 E 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


— Original Massage 


, I (OTD)(CON) 

Wednesday. Septembe r 21, 2005 pm 


Subjec j I d VB Systems 


](OTD) (FBI)j_ 


>TD) (CON) 


SE^ET 


( 101 ) 


X 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 

be 

fo7C 


[ 


Could you plea se tell me the status of the systems that are/were housed in the New Orleans FO? I was talking to 
I l (SMU) yesterday, and she told me the current building will be out of commission for at least 9-12 

months, so I was wondering what has happened to these systems. 

Regards , 


ELSUR Technology Management Unit (ETMU) 
El ectronic Surv eillance Technology Section, OTD 


54C 

541 

541 


'Desk) 

'Fax) 

'Cell) 


b2 

foe 


b7C 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


IOTP) (FBI) 


From: , 

Sent: 

II InY) (FBI) 


To: 

I 1 (OTD) (FBI)l 

IfOTD) (FBI) 

Cc: 

1 |ITD) (CON)jf 

|( 51b) (FBI) 

Subject: 

Switch addresses 


#1 




VBswitefies.xls (21 
KB) 

NON-RECORD 


Greetings Gentlemen, 

I hope you had a peaceful Memorial Day Weekend. 

I have attached my list of Switch addresses. Could you please review for correctness? I know you are constantly 
updating and changing switch addresses. 

l did not have anything loaded in the 8Q Voice Box for t la nd l was not sure if the! Iwas still good. I 

did input both and was successful in pinging both. _ 

Based on the m eetings last week, i f 1 have either s i 1 1 am under the i mpressio n that I need to set up 

two C DCs. for anv I lar aet. One CPC for | I data and one CPC fo | Idata . 

If ar t t arget is usin ci ~E SM net work, do I also need to put the target up in a | "j CDC? 

The CMP has already ordered the RTF for th d t CALEA target. I ha ve provid ed the CMP with the ring 

down number for the audio for the T-3. It is my understanding that the CMP will input th d I CALEA pen data into the 
DCS-3000. You will establish a new IP a ddress and provide me with the IP address, port number, etc. that I need so I can 
get the pen data in the RAs for i l and Line CALEA. _ 

I will be in the BQRA on Tuesday, but not at my desk. Please either call my cell phone 914| |or page me at 

888 1 I cell phone does not work well in Server room.) 

Thank you 

blC 


SENSITIVE BUT UNCLASSIFIED 



From; 

Sent: 

To: 

Subject; 


I l (ITOD)(CON) 


Wednesday. Mav 18. 2005 10:41 AM 

r , j 0TD||FBI1 1 

RE: Pen Register 1 1 


UNCLASSIFIED 

NON-RECORD 


□ 


This is a follow-up to the phone conversation that we had on June 2, 2005. 1 was wondering if you were ahletnanree 
on a meeting date. I will be on vacation on May 20, 2005 thru May 30, 2005. Could you tel! me whether the| | 

CDNRS and J3094 data time are captures as real time or GMT? Will the contract or be able to a add or use an existing 
field to the J3094 voice box file to indicate if a telephone number i j 


20 £ 


- — original Message — . 

From: | l OTODVCON) 

Se nt: Friday, Mav 06, 2005 9:28 AM 
To: l I (OTP) (FBI) 

Subject: Pen Register 


UNCLASSIFIED 

NON-RECORD 


fc6 

lb7C 


From ! ll TODtICONI 

S ent: Friday, April 15. 2005 9:57 AM 
T rl iTOnvonNn 

Subject: FW: Re current pen registers 

UNCLASSIFIED 

NON-RECORD 


Se nt: Thursday. February 20, 2003 9:48 AM 



Subject: Re: Re current pen registers 


to-6 

fo7C 


CM2210 (system no longer used) I am not sure if new format is used by another 
system. 


ADNRS (system no longer used) 




( 104 ) 



9 

*|(QTD) (FBI) 


¥ 


i ' 

From: 

Sent: be 

To: fc>7c 

Subject: 


UL -n ,L - ■ 


UlTOD)(CON) 


Friday, May 06, 2005 9:28 AM 
1 Pen Megister P” 


UNCLASSIFIED 

NON-RECORD 


From: I i TODlfCON) 

To T t lTQOTON) 

Subject: FW: Re current pen registers 

UNCLASSIFIED 

NON-RECORD 



Subject: Re: Re current pen registers 


be 

b7C 


CM2210 (system no longer used) I am not sure if new format is used by another 
system. 

ADNRS (system no longer used) 

PCS (system no longer used) 

CDNRS (system no longer used) But, upload format used by DCS3000 

RDNRS (no longer used) 

JSI - what format is this? 

DISCOVERY - not being used 

J3094 - format being used 
DCS - format being used 
DMW - format being used 

VOICE-ID - 1 did not know there was a format 

PINE - (system no longer used) 

NOKIA - 1 did not know there was a format 

DCSPC - is this similar to DCS? 

[ - system being used; using DMW format 

ICD-14 - format being used . • 

secMt (io6) 


x 



Something to Keep in mind most of these formats need updating to be 

include more fields of data that is being collected but unable to be passed t o b7c 

TA because TA database presently is not coded to handle. Have spoke tol j 

about this and it was decided that we should have a meeting with All to I I 

discuss this and provide reports, files etc. for TA to decide how to handle. 


I ~ ~1 

Telecommunications Intercept & 

Collection Management Unit (T1CTU), b2 

Electronic Surveillance Technology Section bg 

Information Technology Division Ik 7 c 

ERF, Quantico, VA 


Tel: 70 ■ 
Fax: 70 i 


UNCLASSIFIED 


UNCLASSIFIED 


SECRET 


( 107 ) 




I I (OTP) (FBI) 

From: I I (SecD) (CON) 

Sent: , Tuesday Marrh 7% 2005 8:28 AM 

To: I l(ITD)(FBI) 

Subject: 1 l-W: UCH 30UWBUUO 


UNCLASSIFIED fee 

NON-RECORD b7c 


□ 

I am verifying that you are the POC’s for DCS 6000. Also, will you be available for a DOJCERT exercise the 20th and 21st 
of April? 

Tks. 


Inc. 

FBI Enterprise Security Operations Center (ESOC) 
Vul nerability Incid ent Assessment Cell (VIAC) 

202 \ I 


b6 

b7C 


— Or iginal Message — 

From: ! I (UP) (FBI) 

Se nt: Friday, March 25 , 2005 9:02 AM 
Tn: l U Sfxtft (CON) 

Subject: RE: DCS 3000 


UNCLASSIFIED 

NON-RECORD 

b6 

b7C 


I s contact for DCS 3000 

| is Contact for DCS 6000 j 

— Oriqinal Message 

From.- f ' F SecPt (CON) 

To l* Th ' r<:<iaU Marrh M m f lTD) (FBI) 
Subject: DCS 3000 


UNCLASSIFIED 

NON-RECORD 

bs 


( 108 ) 


SECRET 


You are listed as a POC's foi[_ 
you on a DOJCERT exercise. 


I need to know if this is still correct as we will soon need to correlate with iJ 


intelligent decisions, Inc. 

FBI Enterprise Security Operations Center (ESOC) 
Vu lnerability Inc ident Assessment Cell (VI AC) 

204 I 


X 




SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Please review the following e-mail traffic. We will need to get involved sooner than later. 


— Or iginal Message- — 

From:r |(SecD) (FBI) 

Sent: Monday, February 07, 2005 3:33 PM 

To l r SecDVCON): THOMAS, MARCUS C. (ITD) (FBI);| 

B- (SecDI(FBI) I 1 

Cc: I I (SecD) (CON);| l(SecD) (FBI) 

Subject: RE: Portable Voicebox 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 

b 6 
b7C 

□ 

No, this is foolish! We [the SecD collective] have granted an ATO to the Program 
Managers /System Owners to manage their systems (DCS-XXXX) and we're not going to go 
back after the fact and ask for anything more... until either the ATO expires or they've 
demonstrated an inability to make sound risk decisions. 

If AU wants to terminate their ATO(s) then I'll inform AD/ ITD and SAC/CV of that 
decision. 





SECRET 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Q sked me to review the below thread and make a recommendation. After discussing with£ 
we came up with... 


First, based on my recollection, the Voicebox is a portable system, but not necessarily a laptop. Second, since this 
Voicebox is NOT an FBI system that is being connected to a FBI system, it deserves some scrutiny from security, 
which 1 am sure that you have already done. We are assuming that this scenario may repeat itself in the future. 
Therefore, we feel that it would be appropriate for there to be a written operating procedure (most likely a page or two 
at most) that describes the following: 1) the Voicebox while attached to DCS 3000 will be under FBI control, 2) that 
appropriate safeguards are in place (listing safeguards), and 3) describing the sanitization process for ensuring that 
FBI data/information is not falling into the wrong hands when the Voicebox is removed from DCS 3000. 

Once this is written and you review to ensure that it is adequate, we would ask that you please provide a copy of the 
operating procedure to the Accreditation Unit, so we can place it in the DCS 3000 C&A file for future reference. It 
would be the basis for future and similar request to do the same. 

We did something similar to this (somewhat different circumstances) about 18 months ago involving a HIDTA 
operation in Denver. We agree that there is nothing here (at least on the surface) that would require any accreditation 
impact. We would just like it documented in the C&A file 


Hope this meets with your approval. 

If you have any questions or would like to discuss, please let 


I 1 



Subject: FW: Portable Voicebox 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 

□ 


Are you awared of the attached proposal to connect laptops to DCS3000? | | asked if it changed the accreditation 

boundary - 1 would think there is a good chance it does. 1 J 




— Or iginal Message — 

From: | |(SecD) (FBI) 

Se nt: lhursdavTFebruarv1 )3. 2005 9:20 AM 
To: I |SecD) (FBI) fo 6 

Cc:| |SecD)(CON) b?c 

Subject: FW: Portable Voicebox 





SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


he 

hie 


Several months ago, I spoke to you regarding our task force squad that purchased its own Voicebox 
digital collection system and needed the OK from Security Division to use it on FBI cases. This is still in 
the works on our end, but we have a similar situation regarding a portable system and require the input 
of Security Division before we move forward. 

Quantico ERF has supplied our division with a portable Voicebox system, but it is currently in use in our 
Toledo RA. The case agent in our Youngstown RA would like to conduct an upcoming FBI T-III on a 
digital system (rather than cassette tapes), but we do not have another system available (niether does 
ERF). The local HIDTA has purchased a portable Voicebox system and has agreed to let the 
Youngstown RA use it for this T-III. The system will be operated in the RA space and would be 
connected to our DCS-3000 network to obtain telephone target data. According to ERF, there is an 
acceptable configuration which enables secure transfer of the data. The issue arises in regards to 
conducting an F8I case on a system that is not owned by the FBI. As far as the data and audio that will 
be stored on the system is concerned, if necessary, we could remove the hard drives from the system 
before it is returned to HIDTA (replacements would have to be supplied by the FBI and software 
reloaded by the manufacturer). 

From the security standpoint, can we use this system to conduct this upcoming T-III? Are there any 
other issues that must be resolved? 

If you have any questions, please feel free to call me. 

Thanks, 

= 


1=1 


I I 16 

Cl eveland Divisio n b ' 

^office) 

2l| fcell) 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 




I lOTPMFBI) 


From: fo6 I l (ITD) (FBI) 


To: 

b7C 

1 

FlTDWFB'n ' 

Subject: 


1 FWI KWrtfeStb 

L_ i 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


□ his is my response tc 
— Original MSSSflflS , 


CZI 


E 


From; 
Sent: 

it 


Jm>) (FBI) 

lursdav. Ja nuary 13. 2005 1:51 PM 
J (SecDl ICO N) 

1 (rTD) (FBI) 


lb 6 
b7C 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


forwarded 


this message to n 


, I aotmir 

n» 

D 


^1 he said you may be able to help me answer some questions I have abou j ] 

I need is contact information for the system administrator, the ISSO, and the ISSM. 


ir name through 


is our System Administrator, I am the ISSO ant 


Also, I need to know which network r 


CZZD 

"Hjesides o 


s the ISSM for th< 


' 1 h 


b6 

b7C 


Th J I s a self contained Windows domain network which functions as a tool for telecommunication 

interception used in Title III case work. The systems are developed and provided by a contracted vendor which 
in this type of investigative tool. Each field office has a version of this network in place (varying in size according to need) . 
Additionally a number of RAs have a system. The combination of these systems is reaching 100. The systems do have a 
firewalled link to the DCS3000 project which allows the systems to recieve the Call Data Content record information from 
wireless technology intercepted calls. The systems run at the sensitive but unclassified level. 


fo2 
fc 7 F, 


*703 1 ^ | 


he 

fo7C 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 



( 118 ) 


X 







From: ■ 

Sent: fo6 

To: r, , 


Subject: 


I ~l (1TD) (FBI) 

Tuesday, January 18, 20 05 8:25 A|yl_ 
I ^-1(ITDHFBI)r 


J(ITD) (CON) 


(TTO) (FBI); l 


luiQUE&dZ 


Jim) (i-tsi); 


FW: Combining the Collection systems under one C&A 



Clear Day 
Bkgrd.JPG (5 KB) 

NON-RECORD 


UNCLASSIFIED 


FYL.if there is any reason(s) not to... please advise. 


( tr linal Message--- -- 

From : } [ (TTD) (FBI) 

Sent: Tuesday, January 18, 2005 8:21 AM 

To | ITDU FBDl 

Cc i r iTD) (CON) 


be 

b7C 


1 (ITD) (FBI) 


Subject: FW: Combining the Collection systems under one C&A 


UNCLASSIFIED 

NON-RECORD 


Hello Guys, 

Here is an e-mail moving about regarding C&A. 

. b6 

Please review. ib 7 c 

I 3 

Or iginal Message--— 

From: ! I tTD) (FBI) 

Sent: Tuesday, January 18, 2005 8:00 AM _ 

To| |(ITD) (FBI) | |rTD) (FBI);| ” 

fFB U!l llb^D KCON) ! I' SecDI (Fb!7 

Cc: I I f ITD) (CON) 

Subject: Combining the Collection systems under one C&A 


](ITD) 


UNCLASSIFIED 


t X 


( 120 ) 


NON-RECORD SECRET 


Gents, 

After many internal discussion regarding the Certification and Accreditation (C&A) process of 
systems, we [AU, CU, and I] came to the conclusion that combining systems under one C&A makes 
sense (in some cases). I'd like to get your opinion on this matter as I'm looking to combine the 
collections systems ( DCSnet, DCS 3000, 5000, 6000, and J3094) under one C&A (if that makes 
sense to do so). 

I'd like to arrange a meeting for 13:30 tomorrow 19 January to discuss and collect your comments 
We can meet in my office unless someone has a better alternative. 


ISSM, QuanticQ-Gnmalex be 

ERF (703) | J hi§. 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 





I 1 , be 

703 | | b7C 

SENSITIVE BUT UNCLASSIFIED 


SFl^l ( 122 > 


X 




|1TD) (FBI) 

Ifiry 13, 20051:51 PM 

I(SscPKCQN) 

|(ITD) (FBI) 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


forwarded this message to me. 


I I got vour n ame throug rf | he said you may be able to help me answer some questions I have aboutl """Hi 

I need is confact information for the system administrator, the ISSO, and the ISSM. * ■ ■■■■■ 

I 1 b6 

□ s our System Administrator, I am the ISSO and is the ISSM for the | | oject. b7c 


Also, I need to know which network | | resides on. 

The j [ s a self contained Windows domain network which functions as a tool for telecommunication 

inteTOpnornreerrm Title III case work. The systems are developed and provided by a contracted vendor which specializes 
in this type of investigative tool. Each field office has a version of this network in place (varying in size according to need) . 
Additionally a number of RAs have a system. The combination of these systems is reaching 100. The systems do have a 
firewalled link to the DCS3000 project which allows the systems to recieve the Call Data Content record information from 
wireless technology intercepted calls. The systems run at the sensitive but unclassified level. 


SENSITIVE BUT UNCLASSIFIED 


X 


( 123 ) 


.1 (ITD) (FBI) 

MnnHav lleeemESr2Q 2004 4:16 PM 

I m tSb^ 

(ITD) (FBI) 

Response to DCS6000 security, inquiry 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


1 I requested that I respond to your inquiry of th e nrnnress nf the DQ R-fifinn action plan. The duties of the ISSO for 

the DCS-6000 has been reassigned to myself in relief o l | durinq July of 2004. We currently have 100 

different DCS-6000 systems distributed between ERF and division field offices and resident agencies. Below I will address 
the actions items from the original EC. 

The following actions should be completed by ITD: 

C Establish and document standard physical access requirements for deployed systems within 90 days. 

Each fielded system is being updated with the proper security features. This requires a onsite visit by the a Vendor 

representative to be implemented, which requires a coordination of schedules of Vendor and office personnel. If current 
Title 111 collections are ongoing then this requires after-hours scheduling. We have moved from 25% in July to 80% 
complete at this time. Our goal is to complete this process by March 31, 2005. 


C Implement formal Change Management. In the interim, ensure all sites have a 
original configuration in addition to backup tapes. 


ergency repair disk that reflects the 


The Change Management issue has been brought up to the vendor as a necessary of our security requirements. All changes to 
the systems come from the vendor and we are currently two software revisions below their current implementations. The 
vendor will start providing the process in the newer version. We have not moved to the newer software version due to the 
strain of maintaining the requirements of the accreditation process and the time that it takes to implement the changes 
throughout our environment. We will be looking at moving forward in the last half of FY05. 

The vendor has a system of RAIDS and backups to opposite machines within the network for restoration operation. If a 
system must be restored, then the system must be returned to ERF for repair or a Vendor representative sent onsite. No 
tape backups are used, evidence that may be used for a case is stored in real-time on a pair of magneto optical disc. In 
the next version of software offline backup of software will be implemented. 


C Implement a weekly security review to existing audit procedures. The Program Manager and/or the ISSO should review the 
Rules of Behavior and maintain signed copies for all users within 90 days. 

Each system that has been updated has received a notebook detailing the SSP and associated documents. Rules of Behavior 
forms are included for privilege and general users. This notebook details procedures and responsibilities of onsite 
administrators and security personnel. The vendors procedures for managing audit logs is inconsistent and this issue has 
been brought up to them. They are working on correcting this issue, once the issue is resolved and implemented the 
procedures for reviewing and maintaining the audit logs will be standardized for field personnel. 


The DCS3000, DCS5000 and DCS6000 are anticipated to merge into a network and will require a new 
C&A. . / 

SORET ^ (124) 


The DCS-6000 is currently accesses the DCS-3000 network for CDC call information. Each DCS-6000 network system requires 
a CISCO Prx firewall between itself and the DCS-3000. This firewall is strictly configured to allow only desired traffic to the 
designated machines within the DCS-6000 network. 


The Information Technology Security Unit (ITSU)will provide verification to the AU of 
these actions in certification documents for the resulting new system. Maintaining a current accreditation status 
is subject to the continued adherence to the provisions of the SSP. In particular, all media copied or downloaded 
from the DCS 6000 must be scanned for malicious code with the latest available virus scan updates before 
introducing information to any application residing on the FBI LAN/WAN. 


It is our intention to begin the reworking of the SSP at the beginning of 2005 to conform to our operational requirements for the DCS- 
6000. 


Over 90 % of the DCS-6000 system are running McAfee anti-virus software with 100% anticipated by completion of system updates in 
March of 2005. 


At this time there is only one text file of data that may be exported for transfer over to the a FBI/WAN by diskette for upload into an 
application. Less than 20% of offices use this feature and they are required by standard operating procedures to scan this file 
before proceeding. 



he 

hlC 


SENSITIVE BUT UNCLASSIFIED 


From: 

Sent: 

To: 

Subject: 


be 

fo7C 


l,„„ 

FW: DCS 6000 


3 


l (ITD) (FBI) 
0, 2UU4 8:52 AM 
TD) (FBI) 


NON-RECORD 


SENSITIVE BUT UNCLASSIFIED 


h6 

Original Message--- 

From l I (SecD) (CON) 

Se nt: Monday, Decem ber >0, 2004 8:05 AM 

To J tlTD'l fFBP 

c d l (ITD) (FBI); I | (UD) (FBI) 

Subject: DCS 6000 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


1=1 

I currently hav d HL s the ISSO for the DCS 6000. Just as with the DCS 3000 I am now having to 

followup with the progress of the action plan for the DCS 6000. Attached is the EC which identifies the things that are 
supposed to be addressed. Could you work with the owners to determine if any of the items have been addressed, and if 
none, provide projected dates 

to 6 

Respectfully, b7c 


AU, IAS. Security Division 
(202) 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


S^RET 


X 




On the last trip up to Anchorage they wanted to test audio coming from ACS. The audio was fine but the call would not 
disconnect, had to manualy disconnect the line. If you left the line open it actually would disconnect (it took about 1-2 
minutes after the target went on hook. Is there any thing that can be done for this I know it is a known issue but is it being 
looked at to see if it can be corrected. 

Also they were trying to get there VoiceBox to except the digit info from the DCS3000 but I needed the info to put in the 
screen (IP address and port) 

Thank you 



UNCLASSIFIED 


S&^ET 


( 127 ) 


X 


From: I l (ITDHCON) 

Sent: b 6 Wednesday Septem ber 1 5, 2004 6: 1 0 AM 

To: b7c I I TP 1 (FBI) 

Subject: FW: DCS famifyATO 



Clear Day 
BkgrdJPG (5 KB) 


UNCLASSIFIED 


NON-RECORD 


FYI 

V/R 


I 1 


-Original Mptoop- 




H(UD) (FBI) 


Fromq 

Se nt: Monday. Septe mber 13, 2004 1:24 PM 


Subject: DCS family ATO 


icDUCON) 

J(ITD) (CON)|_ 


UNCLASSIFIED 

NON-RECORD 


□ 

Some time ago I approached you, via an e-mail, regarding combining the ATO's for the DCS-family 
of computers (3000, 5000, 6000, DCSnet and J3094). You indicated that you'd like to get to together 
to discuss the Tiers and LOC's for these systems, ultimately to determine if joining them made sense. 

I haven't heard from you, so I thought I'd send a follow-up note to ask about your progress. When 
do you want to meet? 


Cheers 

I 

ISSM, C 
ERF (71 


□ 

3uantico Complex 

4 I 


foe 

fo"7C 


UNCLASSIFIED 


S^RET 


(128) 
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[ 


From: 

Sent: 

To: 

Subject: 


] (OTO) (FBI) 



[ 

[ 


~l nTm (fbi) 

Mondav. Auqust 30. 2004 9:35 AM 

| (ITD) (CON) 

KE: Security Action Items 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


lm back this week, please call or stop by when you get a chance. 


Id 6 
folC 


— Or iginal Message — 

From: | 1 (ITD) (CON) 

Se nt: Monday, August 23, 2004 10:39 AM 

ToL IfrTPHEjBI) 

Cc: | j (ITD) (FBI)J |lTD) (FBI) 

Subject: Security Action Items 


SENSITIVE BUT UNCLASSIFIED 
NON-RECORD 


Good Momingl 


fog In regard to the Security issues that we discussed, please find a draft of the General User Rules of Behavior attached. 
i b7c I am still working the issue regarding the "Mission Exception" statement for a Task force. 

As far as the connection to the DCS-3000, 1 am working wit H f lhe SSP will have to be updated and put into 

the right format. Depending on the Levels of Concerns for the DCS-3000 and DCS-6000 and all of its external 
connections, the C&A or part of the C&A will have to be revalidated. 

We are currently waiting on information for the DCS-3000 and DCSNet. 

& 


SENSITIVE BUT UNCLASSIFIED 


SENSITIVE BUT UNCLASSIFIED 


SE^ET 


( 130 ) 


X 


From: 

Sent: h6 

To: hie 

Cc: 

Subject: 


3 ('TD) (CON) 


Monday August 23. 2 004 10:39 AM 

ifbii - 

JtTD) (FBI)j 


smimy Ataiun remr 


llTD) (FBI) 



DCS-6000 Generl 
User Rules of ... 

SENSITIVE BUT UNCLASSIFIED 

NON-RECORD 


Good Morning T* | 

In regard to the Security issues that we discussed, please find a draft of the General User Rules of Behavior attached. I 
am still working the issue regarding the "Mission Exception" statement for a Task force. 

As far as the connection to the DCS-3000, 1 am working wit h| I The SSP will have to be updated and put into the 

right format. Depending on the Levels of Concerns for the DCS-3OO0 and DCS-6000 and all of its external connections, 
the C&A or part of the C&A will have to be revalidated. 

We are currently waiting on information for the DCS-3000 and DCSNet. 5° 6 

fo7C 

& 

SENSITIVE BUT UNCLASSIFIED 


\ / 


SECRET 


(131) 



l(ITD) (CON) 

St 11, A04 11:47 AM 
DOTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


The DCS3000 column was in my mind to indicate connectivity between the DCS3000 and VoiceBox. I believe that most 
portables do not have the FIX to make that happen. Perhaps other systems out there are still without that connectivity as 


From) I (UD) (FBI) 

Sent; 'We^sday, Auqu^jL 2004 7:53 AM 
To: | r iTD) (CON) 

Subject: RE: Speadsheet 


UNCLASSIFIED 

NON-RECORD 


The notebook column is for a notebook that I am preparing for all sites that will include security information and 
procedure guides and other items for the VoiceBox system. I am working on putting one together and need to fine tune 
it before issuing it to the field. 

I thought of putting a Version Number column at first but I didn’t have all that info so I was just going to use the Yes/No 
choice to designate the systems that I knew were upgraded, but if your guys can fill in all that info with the current 
version number then that will be great. 

What would be in the DCS30G0 column, I know all division offices have connectivity and most RAs? 

— original Message-;:: . 

From: I I lTDI (CON) 

Se nt: Tuesday, August 10, 2004 7:13 PM 
To j ] fTP> (FBI) 

Subject: RE: Speadsheet 


UNCLASSIFIED 

NON-RECORD 


1=1 


I am adding another column to your spreadsheet for DCS3000 connectivity. Since that is key to getting PEN d 

x (132) 




and the Virus protection installed I think that it is valid. I think also that instead of the VB Updated column title that 
Version Number would work better. 


I am curious what the Notebook Provided column is about. And I am guessing that the Schedule Date and 
Complete Date are for scheduling upgrades and new installs and to record what it actually slips to. 

If you agree to the changes that I suggested I woll forward this to the regional managers tomorrow. 

[=□ 

— Or iginal Message — 

b 6 From : I fr TD) ( FBI) 

lb 7C Sent: Tuesday, Auqust 10, 2004 11:23 AM 

To | | TTD) (CON) 

Subject: Speadsheet 


UNCLASSIFIED 

NON-RECORD 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


UNCLASSIFIED 


SE$ET 


X 


( 133 ) 


From: 

Sent: 

To: 

Subject: 


b 6 
b7C 


JITD) (FBI) 


Wprlnssria'/ Aunnstll 2004 9:23 AM 
I i (ITD) (CON) 

RE: Speadsheet2 


UNCLASSIFIED 

NON-RECORD 


I I could you have your guys also verify the infomation in the VB System Type column for correctness. 
Thanks 

□ 

O riginal Message 

From ! 1 (ITD) (CON) 

Sent: Tuesday. August 10. 20&4 7:13 PM 
To: | | TD) (FBI) 

Subject: RE: Speadsheet 


b6 

b7C 

UNCLASSIFIED 

NON-RECORD 


I 1 


I am adding another column to your spreadsheet for DCS3000 connectivity. Since that is key to getting PEN data and 
the Virus protection installed I think that it is valid. I think also that instead of the VB Updated column title that Version 
Number would work better. 

I am curious what the Notebook Provided column is about. And I am guessing that the Schedule Date and Complete 
Date are for scheduling upgrades and new installs and to record what it actually slips to. 

If you agree to the changes that I suggested I woll forward this to the regional managers tomorrow. 



— O riginal Message — 

From! [ITD) (FBI) bo 

Sent : 1 l UBSUdy, AUyiM 2004 11:23 AM b7C 

To i F tp) (con) 

Subject: speadsheet 


UNCLASSIFIED 

NON-RECORD 


S 


a^ET 


(134) 


X 


](OT p ) (FBI) 


I 

From: 

Sent: fo6 

To: bic 

Subject: 


SEp^T 


I 

RE: Speadsheet 


JlTD) (FBI) 
iLll_2p04 7:53AM 
__|{ITD) (CON) 


UNCLASSIFIED 

NON-RECORD 


That will be fine. 

The notebook column is for a notebook that I am preparing for all sites that will include security information and procedure 
guides and other items for the VoiceBox system. I am working on putting one together and need to fine tune it before 
issuing it to the field. 

I thought of putting a Version Number column at first but I didn't have ail that info so I was just going to use the Yes/No 
choice to designate the systems that I knew were upgraded, but if your guys can fill in all that info with the current version 
number then that will be great. 

What would be in the DCS3000 column, I know all division offices have connectivity and most RAs? 


•D) (CON) 
-.13 PM 


Original Mess?qq-- 

Fronl 
Sen) 



be 

UNCLASSIFIED 1 H 
NON-RECORD 


IZZI 

I am adding another column to your spreadsheet for DCS3000 connectivity. Since that is key to getting PEN data and 
the Virus protection installed l think that it is valid. I think also that instead of the VB Updated column title dial Version 
Number would work better. 

I am curious what the Notebook Provided column is about. And I am guessing that the Schedule Date and Complete 
Date are for scheduling upgrades and new installs and to record what it actually slips to. 

If you agree to the changes that I suggested I woll forward this to the regional managers tomorrow. 


- — Orininal Message — - 

Fromj_ | (ITD) (FBI) 

S ent: Tuesday, August 10, 2 004 11:23 AM 
T d K TTD1 (CON) 

Subject; Speadsheet 


be 

h-ic 


UNCLASSIFIED 



X 


(136) 




| (ITD) (CON) 

L2004 7:13 PM 
JlTD) (FBI) 


UNCLASSIFIED 

NON-RECORD 


I am adding another column to your spreadsheet for DCS3000 connectivity. Since that is key to getting PEN data and the 
Virus protection installed I think that it is valid. I think also that instead of the VB Updated column title that Version Number 
would work better. 

I am curious what the Notebook Provided column is about. And I am guessing that the Schedule Date and Complete Date 
are for scheduling upgrades and new installs and to record what it actually slips to. 

If you agree to the changes that I suggested I woll forward this to the regional managers tomorrow. 


I (ITD) (FBI) 
ft. 2004 11:23 AM 
\ (ITD) (CON) 


UNCLASSIFIED 

NON-RECORD 


SEj&ET 


X 



I (ITD) (FBI) 

A.TmctnQ vnnA 10:09 AM 
, , | (ITD) (FBI) 

/irus bean Installation Instructions for Voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 


— O riginal Message — - 
From ! I dTPI (FBI) 

Se nt: Tuesday, August 0 3, 2004 4 -77 PM 

Toj InPUFBDL - - — — J(nP) (CON) 

C d t TD) (FBI) | " |T TD) (FBI) 

Subject: RE: Virus Scan Installation Instructions tor voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 


Have we completed this? Please provide a status. fc7C 

-- — O riginal Message 

Froni TITD) (FBI) 

Se nt: Monday. July 1R . 20&4 12:05 PM 

To j | (rTD) (FBI) j I ITD) (CON) 

Subject: kh: Virus Scan Installation Instructions for Voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 


No, I just heard of it. I will geL 


a Please see that this is done in the field. Please keep track of when all sites are complete and email that back 
. Set a deadline of by the end of the month. If deadline cannot be met I want to know why. Thanks. 


From j pD) (FBI) 

Se nt: Monday. July 14 . 2(1)04 ii:24 AM 

T°1 IOTP) (FBI) | K ITD) (CON) 

Subject: FW: Virus Scan Installation Instructions for Voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 



SE8RET 


/ ' be 

Have we done this yet? bic. 

Original Message— -- 

From| |(ITD) (FBI) 

Sent: I hursday, July us" 2004 11:48 AM 

Tc J f lTD) (FBI ) l I ffTP ) (FBI) 

Subject: FW: Virus Scan Installation Instructions for Voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 


Please distibute this information to the fiel< 


'€=} 


for DCSP distribution. Thanks. 


Telecommunications Intercept and 
C e jection Techn ology Unit (TICTU) 

--urmippi - 

From: | I (ITD) (FBI) 

Se nt: Thursday, July 0 8, 2004 9:50 AM 
To l If UDI (FBI) 

Subject: Virus Scan Installation Instructions for Voicebox Fixed Site Systems 


UNCLASSIFIED 

NON-RECORD 

lb 6 
fo7C 


(S) 


ibl 

b2 

b7E 


Due to the Certification & Accreditation of the Voicebox System, its mandated that all VoiceBox workstations have 
Virus Scan software loaded and running. The attached file contains Instructions for installation and setup on the 
Virus Scan software. The Virus Scan Software should be installed as soon as possible. When completed you 
must email | | to inform him that virus scan is installed and running. 

Your VoiceBox system must have a connerlinrUn the DP.S network. This connection will allow your system to 

connect to the DCS 3000 Web page on the! Inachine. The Web page contains down loads for McAfee 

Virus Scan (for workstations running Windows -iuuu riuifessional) and Netshield (for Windows 2000 Server). The 
connection will also allow the Virus Scan software to update automatically. 


If you have questions please contact: 



| j if you could send this to | 

Thank you SEb^T 


[to request that the DCSP personnel in the field could preform this task. 

( 140 ) 
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Voice Box 

DCS 3000 Vanguard 
Switch Addresses 


DCS 3000 

Local Port 

Remote Port 

IP 1 


0 

5000 



0 

5000 



0 

5001 


0 

5000 


0 

5000 



0 

5000 



0 

5100 



0 

5000 



0 

5000 



0 

5000 



Port 


Elmsford ISG 

ISG-1 

ISG-2 

6195 

619 * 

Boston/New England 

ISG-1 



ISG-2 

61 9f 

Los Angeles/Las Vegas 

ISG-1 



ISG-2 









iSouthern California is the Los Angeles VanGuard and covers Las Vegas, Nevada | 
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b2 

b7E 


# 1056782-000 




